- Replaced password-protected RSA CA with unencrypted ECDSA P-256 CA to prevent manager startup failures from encrypted keys. - Regenerated server and client certificates (client001) with new CA. - Updated CA_SETUP.md to use openssl genpkey (unencrypted) instead of openssl genrsa -aes256, with warning against encrypted keys.