fix(packaging): convert CA key from SEC1 to PKCS#8 for Rust pm-ca parser

The Rust pm-ca crate (crates/pm-ca/src/ca.rs) only parses PKCS#8
format private keys. openssl ecparam -genkey produces SEC1 format
(BEGIN EC PRIVATE KEY), which the Rust ring/RSA parser rejects
with "parse CA private-key PEM", causing the service to crash-loop
on startup.

Proven on LPM: converting ca.key with openssl pkcs8 -topk8 -nocrypt
and restarting patch-manager-web results in:
  Root CA loaded successfully
  Listening (HTTPS) on 0.0.0.0:443

tasks/roadmap.md

@@ -1,44 +0,0 @@
-# Linux Patch Manager — Roadmap
-
-Future work items for the Linux Patch Manager project. Items here are candidates
-for future PRs — promote them to GitHub/Gitea issues when ready to work them.
-
----
-
-## How to use this file
-
-- **Add items** under the appropriate section (or create a new section).
-- **Reference issues/PRs** when known: `(#NN)` at the end of the line.
-- **Promote to issues** when ready to start work — link the issue back to this file.
-- **Mark completed items** with `~~strikethrough~~` and the PR/issue that closed them.
-- **Don't delete completed items** — keep the audit trail.
-
----
-
-## Packaging & Install
-
-_(empty — add items here)_
-
-## CI/CD
-
-_(empty — add items here)_
-
-## Security
-
-_(empty — add items here)_
-
-## Infrastructure
-
-_(empty — add items here)_
-
-## Documentation
-
-_(empty — add items here)_
-
-## Refactoring
-
-_(empty — add items here)_
-
----
-
-_Last updated: 2026-06-10 — created `tasks/roadmap.md`_