fix(certs): share ca.srl ownership after a privileged start

Problem

sudo portless proxy start creates ca.srl as root. Other CA state files are passed through fixOwnership, but ca.srl is not. A later unprivileged start can read the file but cannot update the serial, so OpenSSL writes a partial host certificate and the TLS handshake fails.

Fixes #584.

Change

• Pass ca.srl through fixOwnership in the server and host certificate signing paths, so a privileged start hands it back to the invoking user.
• Remove the partial certificate when signing fails, so the next handshake retries instead of serving a broken file.
• Log the OpenSSL error from the SNI callback.

Tests

Added src/certs-ownership.test.ts to assert both signing paths hand ca.srl to fixOwnership, and a regression test in src/certs.test.ts that makes the serial read-only, forces the signing failure, and checks the partial certificate removal and error log.

• pnpm --filter portless test (1249 passed, 1 skipped)
• pnpm --filter portless type-check
• pnpm --filter portless lint