fix(client): isolate prefixed client config files

[ahcrm-core]

Summary

Fix the client-name prefix boundary described in #43.

A client such as foo could previously bundle foo-bar's generated VPN configurations into foo.zip. Revoking foo could also delete foo-bar's OpenVPN configurations.

This change:

• bundles only the exact generated configuration formats for the requested client;
• removes only the exact OpenVPN configuration filenames generated for the revoked client;
• adds regressions for both the ZIP disclosure and cross-client deletion paths.

Fixes #43.

Verification

Focused security regressions:

2 passed

Relevant unit files:

46 passed

Formatting and static lint:

ruff format --check .  # passed
ruff check .           # passed
git diff --check       # passed

Full unit tier:

469 passed, 3 failed

The three failures are pre-existing version-consistency failures tracked by #38: the chart still declares v2.1.14 while VERSION and the changelog are at v2.1.15. This change does not touch deployment artifacts, VERSION, or the changelog.

Integration, end-to-end, and Kubernetes tiers were not run locally.