[Bikebrainz]

Included in merged #22, which adds the final DNS/IP SAN checks and passed all eight CI jobs on its reviewed integration head. This draft is closed as superseded; no separate merge is needed.

Persisted proxy leaves were reused when their subject and dates looked valid even if the CA had changed or the private key no longer matched. That left HTTPS interception failing after restart.

Disk-cache reuse now verifies the certificate against the current CA and compares its public key with the private key's public component. Damaged keys, invalid signatures and stale issuers trigger regeneration. Valid cached leaves remain unchanged. Checks run once per host on disk load; later connections use the in-memory cache.

The public changelog, developer changelog and certificate-cache roadmap entry describe the recovery behavior and remaining limits. Live CA replacement and cache-management controls remain unfinished.

Validation:

• Reproduced stale-CA reuse and mismatched-key reuse with the original CertAuthority implementation.
• The expanded runtime test fails against the original full app at the mismatched-key TLS handshake.
• Full local Windows app build passed; all 60 runtime checks passed, including strict HTTPS, valid reuse, legacy leaf replacement, damaged and mismatched keys, invalid signature, replaced CA, native UI startup and existing request/project checks.
• Focused certificate tests confirm legacy replacement and valid reuse.
• 81 Markdown targets, 3 script-integrity hashes and 117 website pages passed; generated roadmap stays synchronized.

This builds on #21. Cross-platform CI is required before merge.