piv: store certificates compressed when they don't fit (CLI + GUI)

[framefilter]

keyroost can now store a PIV certificate gzip-compressed: the PIV standard's form (CertInfo 0x01, NIST SP 800-73-4 Part 1 Appendix A). This lets certificates too large for a slot fit; the limit is about 3 KB on a YubiKey 5.

Behaviour

• Automatic (default): store the certificate uncompressed. If the card refuses it as too large, store it compressed and say why. The card's refusal is the only size signal; there is no per-device size table.
• --compress / --no-compress on piv import-cert and piv self-sign force it either way.
• GUI parity: a Compression choice (Automatic / Always / Never) in the Import certificate and Self-signed dialogs, with the same notices and errors as the CLI.
• After every compressed write, keyroost reads the certificate back and compares it with the original before reporting success.
• Status: piv status shows "stored compressed" in text, and cert_compressed in --json. The GUI slot line shows "compressed".
• Learn site: docs/piv.html gains a "Compressed certificates" section.

Implementation

• The byte layer (keyroost-piv) gets a CertInfo choice in encode_certificate. It stays compressor-free.
• The transport adds a gzip writer next to the existing reader: MTIME 0 for reproducible output, correct CRC32 and ISIZE, no new dependency. It also adds CertCompression / CertImport on import_certificate and self_signed_certificate.

Verified on a YubiKey 5.7 (slot 9D)

Case	Result
6164 B certificate, automatic	stored compressed (831 B on the card), with the explanatory note
Same certificate, --no-compress	clear "too large" error; the slot's existing certificate unchanged
1985 B certificate, automatic	stored uncompressed
1985 B certificate, --compress	stored compressed (555 B)
self-sign --compress with a new key	piv test passes
Independent readers	ykman and OpenSC 0.26.1 read every compressed certificate keyroost wrote byte-identically, including one written through the GUI
GUI	Import (Automatic, Never) and Self-signed (Always) dialogs exercised on a virtual X display, with the notices, errors and slot line checked

Windows and macOS: in a community test on Windows 11 (#152), Windows' built-in PIV smart-card driver read a certificate keyroost stored compressed; the YubiKey Minidriver did too. macOS's built-in PIV support has not been verified, and the notes and Learn page say so. Automatic mode only compresses a certificate the card would otherwise refuse, so it cannot break an import that works today.

Checks: fmt, clippy -D warnings, workspace tests, cargo doc -D warnings, changelog check, docs audit (including the new CLI flags in docs/piv.html).

🤖 Generated with Claude Code

https://claude.ai/code/session_01Skvxkb6eMzytjPDmL6mPYU

[n0xena]

I'd like to note: the ~3kB-ish are YubiKey 5 specific
if I recall correctly the spec state only about ~1.6kB-ish (+/-)
also: yubico specifies about 50kB max over all 64k object slots, including the 24 standard slots but excluding the actual keys
fully populating just the standard slots would result in 24 x 3kB = 72kB - which is already 12kB over total available storage
so any test should be done against official spec with any above that purely vendor/model specific!

[framefilter]

Thanks, agreed. #154 doesn't assume any size: keyroost never pre-checks a limit. It writes the certificate uncompressed and only compresses it if the card itself refuses it as too large, so a card with a smaller limit is handled the same way. The ~3 KB figure only appears as a YubiKey 5 example in the docs. On the spec: SP 800-73-4 lists 1856 bytes as a recommended certificate length and says certificates can exceed it. A card whose storage is full gets its own "no room left" error rather than a retry.