fix(ca): gate per-service cert/key download behind TOTP+admin scope; require explicit PFX password; add rate limit (DC-076) [glm-grade=A]

dashcaddy-api/src/utilities/middleware.js

@@ -426,8 +426,21 @@ module.exports = function configureMiddleware(app, {
     { path: '/api/v1/ca/root.crt',       exact: true,  method: 'GET' },
     { path: '/api/v1/ca/install-script', exact: true,  method: 'GET' },
     { path: '/api/v1/health/ca',         exact: true,  method: 'GET' },
-    { path: '/api/v1/ca/cert/',          prefix: true, method: 'GET' },
-    { path: '/api/v1/ca/certs',          exact: true,  method: 'GET' },
+    // DC-076: /api/v1/ca/cert/<domain> and /api/v1/ca/certs MUST stay gated
+    // by TOTP/session. The /cert/<domain> endpoint returns the private key
+    // (format=key and format=pem both embed `server.key`; format=pfx wraps
+    // the same key in a PKCS#12 envelope). If an operator disables TOTP at
+    // any point in the future (ops command, fresh install with TOTP off
+    // during setup, .disabled-* rename of totp-config.json), an unauthenticated
+    // attacker reaching `https://ca.sami/api/ca/cert/<any-domain>?format=key`
+    // would receive the per-service RSA private key for every service whose
+    // cert Caddy has ever signed — that's a per-service key disclosure, not
+    // just a CA fingerprint leak. The `/api/v1/ca/info`, `/root.crt`, and
+    // `/install-script` paths above stay public (the root CA cert is public
+    // by design — devices need it to trust *.sami TLS); only the per-service
+    // private key and per-service cert list go behind auth. See DC-076 for
+    // the corresponding rate-limit + admin-scope + password-required
+    // hardening in routes/ca.js.
     { path: '/api/v1/csrf-token',        exact: true,  method: 'GET' },
     { path: '/api/v1/logo',              exact: true,  method: 'GET' },
     { path: '/api/v1/favicon',           exact: true,  method: 'GET' },