feat: move step-ca into a plugin (C4)

plugins/step-ca/README.md

@@ -0,0 +1,31 @@
+# Step CA
+
+Adds the `stepca` SSH auth type: Termix signs you in with the identity
+provider behind a [smallstep step-ca](https://smallstep.com/docs/step-ca/)
+OIDC provisioner, has the CA sign a fresh key, and keeps the short-lived SSH
+certificate until it expires.
+
+Termix never runs the `step` binary. It talks to the CA's HTTPS API
+(`/root/<fingerprint>`, `/provisioners`, `/1.0/ssh/sign`) and to the identity
+provider directly, through core's outbound request guard.
+
+## Settings
+
+Admin settings, under Settings > Plugins > Step CA:
+
+- **CA URL**, **Root fingerprint** and **OIDC provisioner name**. Leave all
+  three empty to turn Step CA off.
+- **Allowed private Step CA hosts**: the CA and, if it is internal, the
+  identity provider. Anything private that is not listed is refused.
+- **Redirect URI**: register it with the identity provider:
+  `<base URL>/plugin-api/step-ca/callback`, or
+  `<base URL>/host/step-ca-callback` while "Use the old redirect URI" is on.
+
+An install upgraded from 2.8 has its Step CA settings copied in and keeps
+the old redirect URI turned on.
+
+## Several instances
+
+With `REDIS_URL` set, a callback that reaches another Termix instance is
+handed to the one that started the sign-in. `TERMIX_STEP_CA_REDIS_PREFIX`
+changes the key prefix (default `termix:step-ca`).