fleet-manager: auto-renew the agent-plane server cert (step-ca sidecar + hot-reload)

The agent-plane server cert was issued by hand (server-pki.sh / docker exec
step ca certificate), which needs the step CLI on the host, re-specifies SANs
each time, and silently expires at the CA's 90-day cap — the exact failure that
just broke agent TLS (cert minted with a stale SAN, missing manager.fleet.lab).

Automate it:
- agent-cert-renewer sidecar (smallstep step-cli image, compose profile
  cert-auto): issues the cert once from the co-located fleet step-ca, then
  'step ca renew --daemon' rotates it before the cap. Renewal preserves the
  subject + SANs, so SAN drift cannot recur. Chowns to the manager's nonroot
  uid so the distroless manager reads the key. Opt-in + only valid where the CA
  is co-located; server-pki.sh stays as the manual/remote-CA path.
- manager hot-reloads via GetCertificate (certreload.go): a rotated cert on
  disk is picked up on the next handshake with no restart and no dropped agent
  streams; a half-written pair keeps the last good cert serving. Unit-tested.
- defaults.env documents the cert-auto knobs; DEPLOY.md §2a recommends the
  renewer and flags the mandatory manager.fleet.lab SAN.

serving/fleet-manager/server-pki.sh

@@ -8,6 +8,11 @@
 # fleet CA — this script issues it via `step ca certificate` against the running
 # fleet step-ca (serving/dot1x-bench/), the same CA that signs enrolment certs.
 #
+# NOTE: where the fleet step-ca is CO-LOCATED on this host, prefer the
+# `agent-cert-renewer` compose sidecar (docker-compose.yml, profile cert-auto) —
+# it does this issuance AND auto-renews before the CA's ~90-day cap, preserving
+# SANs, with no `step` CLI on the host. This script is the manual / remote-CA path.
+#
 # This does NOT issue:
 #   - the ADMIN-plane UI cert   -> owned by the Traefik ingress (Let's Encrypt
 #                                  DNS-01); the manager never terminates TLS. See DEPLOY.md §2c.