feat(portal): sign Apple profiles — Verified instead of 'unsigned' warning

Unsigned .mobileconfig installs trip macOS warnings ('unknown developer')
and an extra System Settings hunt. The route now wraps the profile in
PKCS#7 SignedData (node-forge, SHA-256, full chain embedded) using the
portal's own cert-manager LE certificate mounted read-only into the pod
(PROFILE_SIGN_CERT/KEY). Publicly-trusted chain → Apple shows Verified.
Dev (no env) and any signing failure fall back to unsigned — the
download must never break over the badge. Signature round-trip verified
with openssl smime.

apps/portal/package.json

@@ -12,6 +12,7 @@
   },
   "dependencies": {
     "ioredis": "^5.11.1",
+    "node-forge": "^1.4.0",
     "nuxt": "^4.4.6",
     "nuxt-oidc-auth": "1.0.0-beta.11",
     "undici": "^7.2.1",
@@ -20,6 +21,7 @@
   },
   "devDependencies": {
     "@types/node": "^20.0.0",
+    "@types/node-forge": "^1.3.14",
     "typescript": "^5.6.0",
     "vue-tsc": "^3.2.6"
   },