fix(remote-input): preserve phone trust across restarts and IP changes

[zhou-zhichao]

Remote input currently replaces the certificate trusted by the phone whenever a new LAN or virtual-adapter IP appears. For example, a virtual adapter changing from one private subnet to another invalidates Safari's earlier trust even when the actual Wi-Fi address stays the same. The phone setup panel is also hidden, and the downloadable root profile contains a non-CA server certificate.

This change persists a unique CA per computer and uses it to sign a separate server certificate. Restarts reuse the identity; new addresses or approaching leaf expiry reissue only the server certificate. The identity is saved as one atomic private bundle, and damaged, mismatched, or expiring CA material causes an explicit error rather than silently replacing the trust anchor. Tauri and Linux egui share this implementation and both serve public CA downloads as .cer and .mobileconfig files.

The phone pairing page now has a collapsed, accessible setup panel with separate iPhone and Android downloads. Desktop settings can copy the iPhone profile URL. All five locales explain installation and full trust, and profile identifiers include the CA fingerprint so different computers do not replace each other's profiles.

Older installations need a one-time certificate replacement. iOS still requires the user to install the profile and enable full trust; this is not silently automatable by a desktop app. The CA can issue certificates, so the UI and documentation describe its trust scope and removal. Existing v4 files remain available for rollback, and ordinary upgrades preserve the new identity in user configuration. See docs/remote-input-certificates.md for backup, recovery, and continuous-uptime limits.

Validation:

• Seven Rust TLS regression tests pass, including real handshakes using only the downloaded CA, restart reuse, IP changes, renewal, damaged keys/signatures, persistence failure, and legacy-file preservation.
• The 70-file frontend/contract suite and production frontend build pass.
• Windows release build and final cargo check --locked pass (existing unrelated warnings remain).
• Playwright checks at a 390 px mobile viewport pass in all five locales: setup expands, both download links are available, and there are no script errors or horizontal overflow.
• Linux CI passed, including the shared TLS suite and Unix key-permission test. Native Linux GUI host and physical iPhone verification remain pending.
• A targeted backport to the reporter's existing 1.3 installation was built and installed with a backup. Live HTTPS checks passed for localhost, loopback IP, and the LAN IP using a custom CA trust store with certificate and hostname verification enabled. The downloaded profile was parsed as a plist and matched the stored public CA; a verified WSS upgrade and PIN authentication also passed without starting a recording.