Replace Pebble with step-ca for local ACME

Pebble skipped real HTTP-01 validation, which hid integration gaps
for compliance-page custom domains. step-ca with a Caddy port-80
proxy exercises the same path production uses while keeping issued
certs persistent across compose restarts.

Signed-off-by: Bryan Frimin <bryan@probo.com>

compose/caddy/Caddyfile

@@ -0,0 +1,5 @@
+# Proxies ACME HTTP-01 validation (port 80) to probod's trust-center HTTP
+# listener on the host (:10080 by default).
+:80 {
+	reverse_proxy host.docker.internal:10080
+}

compose/pebble/pebble-config.json

@@ -1,14 +0,0 @@
-{
-  "pebble": {
-    "listenAddress": "0.0.0.0:14000",
-    "managementListenAddress": "0.0.0.0:15000",
-    "certificate": "/test/config/certs/pebble.crt",
-    "privateKey": "/test/config/certs/pebble.key",
-    "httpPort": 5002,
-    "tlsPort": 5001,
-    "ocspResponderURL": "",
-    "externalAccountBindingRequired": false,
-    "domainBlocklist": [],
-    "certificateValidityPeriod": 157766400
-  }
-}

compose/step-ca/README.md

@@ -0,0 +1,26 @@
+# step-ca local CA
+
+This directory holds the persistent [step-ca](https://github.com/smallstep/certificates)
+state for local custom-domain TLS. It is initialized on first `make stack-up`.
+
+After the first run, install the root CA once so browsers and server-side TLS
+clients (e.g. CIMD OAuth) trust issued certificates across restarts:
+
+```bash
+step certificate install compose/step-ca/certs/root_ca.crt
+```
+
+The ACME directory URL is `https://localhost:9000/acme/acme/directory`.
+
+step-ca shares the `acme-http-01-proxy` container network so HTTP-01 validation
+to `http://<hostname>/.well-known/acme-challenge/...` reaches Caddy on port 80,
+which forwards to probod's trust-center HTTP listener on the host.
+
+## Custom domain DNS (optional)
+
+Managed compliance-page domains (`*.probopage.localhost`) resolve via the
+`.localhost` TLD and skip DNS checks.
+
+For customer custom domains in local dev, point DNS at the host via
+`/etc/hosts` and ensure HTTP-01 reaches probod through the
+`acme-http-01-proxy` service on port 80.