Sign Sunshine certs with a 1Password-backed root CA

Replaces Sunshine's self-signed cert with one minted from a private root CA
whose key material lives in 1Password. Every host running install.sh fetches
the CA via 'op read', mints itself a host cert with SANs for <hostname>.lan
and the current LAN IP, and installs the CA into the system trust store.

Bootstrap (run once, anywhere)
- scripts/cert-bootstrap.sh: generates a 4096-bit RSA root CA (10y validity),
  uploads it as a Secure Note titled "Omarchy-Stream Root CA" in the Private
  vault with two fields: cert (text) and key (concealed). Refuses to overwrite
  an existing item without --force.

Per-host (lib/certs.sh)
- fetch_and_install_certs: reads op://Private/Omarchy-Stream Root CA/{cert,key}
  to a tmpfs-staged temp dir (XDG_RUNTIME_DIR), mints a host cert via openssl
  with serverAuth + clientAuth EKU, drops cert/key at ~/.config/sunshine/
  credentials/{cacert,cakey}.pem, installs the CA at
  /etc/ca-certificates/trust-source/anchors/omarchy-stream-ca.pem and runs
  update-ca-trust.
- Idempotent: skips re-mint when on-disk cert is signed by the current CA,
  has the expected SANs, and isn't within 30 days of expiry. Override with
  FORCE_CERTS=1 or --force-certs.

install.sh
- Adds --no-certs, --force-certs flags; sources lib/certs.sh; runs cert step
  after permissions/config and before firewall so the service restart at the
  end of install picks up the new cert.

client/install-macos.sh
- After installing Moonlight, if `op` is available and signed in, fetches the
  CA and adds it as a trusted root to /Library/Keychains/System.keychain via
  `security add-trusted-cert -d -r trustRoot`. Skips cleanly when op isn't
  ready.

uninstall.sh
- Adds --remove-ca-trust to delete the system trust anchor. By default the
  CA is left in place since other tools may rely on it.

verify.sh
- Adds checks for: cert signed by omarchy-stream CA, cert >30 days from
  expiry, CA present in system trust store.

Docs
- README "Trusted TLS certs via 1Password" section: bootstrap flow, per-host
  flow, client trust matrix (Linux / macOS / iOS / Android / Apple TV),
  re-pairing note (first cert install on a host invalidates pinned Moonlight
  fingerprints), config env vars.
- client/README gains per-platform CA-trust install steps with concrete
  `op read` + platform-specific commands.

uninstall.sh

@@ -9,16 +9,20 @@ source "$SCRIPT_DIR/lib/common.sh"
 
 PURGE=0
 KEEP_MOONLIGHT=0
+REMOVE_CA_TRUST=0
 while [[ $# -gt 0 ]]; do
   case "$1" in
-    --purge)          PURGE=1 ;;
-    --keep-moonlight) KEEP_MOONLIGHT=1 ;;
+    --purge)            PURGE=1 ;;
+    --keep-moonlight)   KEEP_MOONLIGHT=1 ;;
+    --remove-ca-trust)  REMOVE_CA_TRUST=1 ;;
     -h|--help)
       cat <<EOF
-Usage: $(basename "$0") [--purge] [--keep-moonlight]
+Usage: $(basename "$0") [--purge] [--keep-moonlight] [--remove-ca-trust]
 
-  --purge            Also delete ~/.config/sunshine and ~/.local/share/sunshine
-  --keep-moonlight   Do not uninstall moonlight-qt
+  --purge             Also delete ~/.config/sunshine and ~/.local/share/sunshine
+  --keep-moonlight    Do not uninstall moonlight-qt
+  --remove-ca-trust   Remove the omarchy-stream CA from /etc/ca-certificates
+                      (default: leave it — other hosts/services may rely on it)
 EOF
       exit 0 ;;
     *) err "Unknown option: $1"; exit 2 ;;
@@ -57,9 +61,24 @@ if [[ -f /etc/udev/rules.d/60-uinput.rules ]]; then
   as_root udevadm control --reload-rules
 fi
 
+if [[ $REMOVE_CA_TRUST -eq 1 ]]; then
+  step "Removing omarchy-stream CA from system trust store"
+  anchor="/etc/ca-certificates/trust-source/anchors/omarchy-stream-ca.pem"
+  if [[ -f "$anchor" ]]; then
+    as_root rm -f "$anchor"
+    as_root update-ca-trust extract >/dev/null
+    ok "Removed $anchor and refreshed trust store"
+  else
+    info "CA anchor not present; nothing to remove"
+  fi
+fi
+
 if [[ $PURGE -eq 1 ]]; then
   step "Purging Sunshine user data"
   rm -rf "$HOME/.config/sunshine" "$HOME/.local/share/sunshine"
 fi
 
 ok "Uninstall complete. Firewall rules and 'input' group membership were left in place."
+if [[ $REMOVE_CA_TRUST -eq 0 ]]; then
+  info "The omarchy-stream CA was left in /etc/ca-certificates (--remove-ca-trust to drop it)."
+fi