CERT_DAYS setting, --days CLI flag, and a Days field in the TUI cert
form. "default"/"" inherit EasyRSA's own EASYRSA_CERT_EXPIRE so that
deploying this cannot silently shorten certs on an existing PKI.
Records why --days=N beats exporting EASYRSA_CERT_EXPIRE, and why the
local rejection of 0 is a fast-fail mirror of EasyRSA's own gate rather
than a substitute for it.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
