feat: add full certificate chain download and display support

[krakenhavoc]

Summary

• Add ChainPem field to TlsCert type and TlsCertChainInfo/TlsCertChainEntry types
• Add GetCertChain() API client method for GET /certs/tls/:id/chain
• cert download now supports --format flag: cert (leaf only), chain (intermediates), fullchain (leaf + intermediates)
• cert issue and cert submit now write chain and fullchain files alongside the leaf cert (--chain-out, --fullchain-out)
• cert show displays intermediate chain details (subject, issuer, fingerprint)

Test plan

• 9 new tests: download formats (chain, fullchain, no-chain error, invalid format, default filenames), show with intermediates, issue/submit chain file output
• All 38 CLI cert tests pass (go vet + go test -race)
• Manual: krakenkey cert download <id> --format fullchain against staging API
• Depends on: feat: add full certificate chain support app#79 (backend chain endpoint)