Add TLS certificate generation and server initialization utility

Implement a certificate generation module in pwr-server that produces
self-signed ECDSA P-256 certificates for TLS 1.3 via the rcgen crate.
generate_certificate accepts a common name (typically the server hostname),
creates certificate parameters with a distinguished name, generates a P-256
keypair, self-signs the certificate with a 365-day validity, and returns
the PEM-encoded certificate, PEM-encoded private key, and a SHA-256 hex
fingerprint of the certificate for client-side pinning.

save_certificate writes the certificate and key to the configured paths
with appropriate permissions: the certificate file is world-readable while
the private key is restricted to owner-only (mode 0o600 on Unix). Parent
directories are created automatically.

The init_server function ties everything together for first-time setup. It
generates the TLS certificate and key, saves them to /etc/pwr/, generates
a random 256-bit PSK via ring’s CSPRNG, creates a ServerConfig with the
PSK and certificate paths, and saves the config to /etc/pwr/server.toml.
The PSK hex string and certificate fingerprint are printed to stdout with
instructions for copying the PSK to the client config. This gives
administrators a single command to bootstrap a new pwr-server instance
with all security material generated fresh and properly permissioned.