feat: move step-ca into a plugin (C4)

packages/plugin-sdk/src/backend.ts

@@ -1490,6 +1490,12 @@ export interface PluginFetchInit {
   allowPrivateHosts?: readonly string[];
   /** Aborts the request, and a streamed body, when the caller gives up. */
   signal?: AbortSignal;
+  /**
+   * TLS for a private CA. `ca` trusts this PEM bundle instead of the system
+   * store. `rejectUnauthorized: false` skips verification, only for fetching
+   * a CA root by fingerprint, where the caller checks the answer itself.
+   */
+  tls?: { ca?: string; rejectUnauthorized?: boolean };
 }
 
 /**

packages/plugin-sdk/src/testing.ts

@@ -878,7 +878,7 @@ export function createFakeContext(
       requiresSecret: (authType) =>
         ["password", "key", "credential", "agent"].includes(authType),
       supportsBackground: (authType) =>
-        !["none", "stepca"].includes(authType) &&
+        authType !== "none" &&
         !auth.sshAuthProviders.some(
           (provider) =>
             provider.type === authType && provider.supportsBackground === false,