feat: 初始化 kdbx-viewer 项目

实现服务端解密的 KeePass 网页查看器，包含登录门户口令与验证码、RSA+会话级 AES 加密通道、审计日志持久化、HTTPS 自动证书、Docker 部署配置及端到端测试。

gen-cert.js

@@ -0,0 +1,39 @@
+'use strict';
+// 生成自签名证书用于本地 HTTPS / 容器默认 HTTPS（开发/自托管用，生产请使用受信任证书）
+const fs = require('fs');
+const path = require('path');
+const forge = require('node-forge');
+
+// 生成自签证书到指定路径；cn 默认 localhost，可传入额外 SAN/主机名
+function generateSelfSigned(keyPath, certPath, cn) {
+  cn = cn || 'localhost';
+  const keys = forge.pki.rsa.generateKeyPair(2048);
+  const cert = forge.pki.createCertificate();
+  cert.publicKey = keys.publicKey;
+  cert.serialNumber = Math.floor(Math.random() * 0xffffffffffff).toString(16);
+  cert.validity.notBefore = new Date();
+  cert.validity.notAfter = new Date(Date.now() + 3650 * 86400000); // 10 年
+  const attrs = [{ name: 'commonName', value: cn }];
+  cert.setSubject(attrs);
+  cert.setIssuer(attrs);
+  // 扩展：仅 localhost 场景足够，浏览器会提示自签不可信（属预期）
+  cert.sign(keys.privateKey, forge.md.sha256.create());
+
+  const keyPem = forge.pki.privateKeyToPem(keys.privateKey);
+  const certPem = forge.pki.certificateToPem(cert);
+  const dir = path.dirname(keyPath);
+  fs.mkdirSync(dir, { recursive: true });
+  fs.writeFileSync(keyPath, keyPem);
+  fs.writeFileSync(certPath, certPem);
+  return { keyPem, certPem };
+}
+
+module.exports = { generateSelfSigned };
+
+// 作为脚本直接运行时：按默认路径生成，便于手动预生成
+if (require.main === module) {
+  const defKey = path.join(__dirname, 'ssl', 'key.pem');
+  const defCert = path.join(__dirname, 'ssl', 'cert.pem');
+  generateSelfSigned(defKey, defCert, 'localhost');
+  console.log('SSL 自签证书已生成: ssl/key.pem, ssl/cert.pem');
+}