fix Cryptgeon protocol and add CA passphrase / external config resolution

Cryptgeon's real protocol (verified against upstream occulto/frontend/backend
source) never matched what create_note() sent: it used a SHA-256-derived key
instead of the raw one, a single-blob ciphertext instead of the delimited
AES-GCM--nonce--ciphertext format, an empty meta field instead of a JSON
string, and a hash-bang URL instead of the real /note/<id>#<key> route -
notes uploaded fine but were undecryptable in the browser.

Also adds CA_PASSPHRASE auto-detection/prompting ("" auto-detects an
encrypted CA key and prompts, "!empty"/"!ask" opt out of/force the prompt)
and an external .conf file (--config / CONFIG_PATH / <script>.conf) that can
override the SETTINGS block without editing the script.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

tests/test_config_file.py

@@ -0,0 +1,62 @@
+import pytest
+from openvpncertupdate import load_settings_overrides, ConfigError
+
+
+def _script_path(tmp_path):
+    return str(tmp_path / "openvpncertupdate.py")
+
+
+def test_default_path_missing_returns_empty_silently(tmp_path):
+    overrides = load_settings_overrides(None, "", _script_path(tmp_path))
+    assert overrides == {}
+
+
+def test_default_path_found_loads_overrides(tmp_path):
+    conf = tmp_path / "openvpncertupdate.py.conf"
+    conf.write_text('EASYRSA_DIR = "/custom/easyrsa"\n')
+    overrides = load_settings_overrides(None, "", _script_path(tmp_path))
+    assert overrides == {"EASYRSA_DIR": "/custom/easyrsa"}
+
+
+def test_explicit_cli_path_missing_raises(tmp_path):
+    missing = str(tmp_path / "missing.conf")
+    with pytest.raises(ConfigError, match=missing):
+        load_settings_overrides(missing, "", _script_path(tmp_path))
+
+
+def test_explicit_configured_path_missing_raises(tmp_path):
+    missing = str(tmp_path / "missing2.conf")
+    with pytest.raises(ConfigError, match=missing):
+        load_settings_overrides(None, missing, _script_path(tmp_path))
+
+
+def test_cli_path_takes_priority_over_configured_path(tmp_path):
+    cli_conf = tmp_path / "from_cli.conf"
+    cli_conf.write_text('EASYRSA_DIR = "/from/cli"\n')
+    configured_conf = tmp_path / "from_configured.conf"
+    configured_conf.write_text('EASYRSA_DIR = "/from/configured"\n')
+
+    overrides = load_settings_overrides(str(cli_conf), str(configured_conf), _script_path(tmp_path))
+    assert overrides == {"EASYRSA_DIR": "/from/cli"}
+
+
+def test_unrecognized_and_config_path_names_are_filtered_out(tmp_path):
+    conf = tmp_path / "openvpncertupdate.py.conf"
+    conf.write_text(
+        'EASYRSA_DIR = "/custom/easyrsa"\n'
+        'SOME_RANDOM_NAME = "y"\n'
+        'CONFIG_PATH = "/should/not/apply"\n'
+    )
+    overrides = load_settings_overrides(None, "", _script_path(tmp_path))
+    assert overrides == {"EASYRSA_DIR": "/custom/easyrsa"}
+
+
+def test_comments_and_non_string_types_supported(tmp_path):
+    conf = tmp_path / "openvpncertupdate.py.conf"
+    conf.write_text(
+        "# a comment\n"
+        "SMTP_PORT = 2525\n"
+        'CA_PASSPHRASE = ""   # inline comment\n'
+    )
+    overrides = load_settings_overrides(None, "", _script_path(tmp_path))
+    assert overrides == {"SMTP_PORT": 2525, "CA_PASSPHRASE": ""}