feat(security): instance CA + service identity certs (M1)

- lib/pki: root CA provisioning on first run (~/.dcntrlized/pki/), per-service
  leaf identity issuance (90d, refreshed at start), revocation with CRL
- main: EnsureCA on startup
- start: inject CA + identity mounts and AUTH_* mTLS env into compose services
- uninstall: revoke the service's cert (CRL entry published)

src/lib/containers/install.go

@@ -160,6 +160,12 @@ func getDataRoot() (string, error) {
 	return filepath.Join("/data", ".dcntrlized"), nil
 }
 
+// DataRoot is the exported accessor for the storage root shared by installed
+// container metadata and the instance PKI (CA + service identities).
+func DataRoot() (string, error) {
+	return getDataRoot()
+}
+
 // EnsureDataRoot creates the data root directory if it does not exist yet.
 // This gives a clear, early error when the install directory is missing or not
 // writable (e.g. the container's bind mount source was removed) instead of a