pki: add minimal certificate authority

- CA generation with encrypted private key storage (AES-256-GCM)
- Client certificate issuance with configurable validity
- Certificate revocation with status tracking
- SHA1 fingerprint integration with existing mTLS auth
- API endpoints: /pki/status, /pki/ca, /pki/issue, /pki/revoke
- CLI commands: fpaste pki status/issue/revoke
- Comprehensive test coverage

Containerfile

@@ -1,7 +1,27 @@
-# FlaskPaste Container Image
+# FlaskPaste Container Image (Multi-Stage Build)
 # Build: podman build -t flaskpaste .
 # Run:   podman run -d -p 5000:5000 -v flaskpaste-data:/app/data flaskpaste
 
+# Stage 1: Build dependencies
+FROM python:3.11-slim AS builder
+
+WORKDIR /build
+
+# Install build dependencies
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    gcc \
+    && rm -rf /var/lib/apt/lists/*
+
+# Create virtual environment
+RUN python -m venv /opt/venv
+ENV PATH="/opt/venv/bin:$PATH"
+
+# Install Python dependencies
+COPY requirements.txt .
+RUN pip install --no-cache-dir -r requirements.txt gunicorn
+
+
+# Stage 2: Runtime image
 FROM python:3.11-slim
 
 LABEL maintainer="FlaskPaste"
@@ -10,19 +30,19 @@ LABEL description="Lightweight secure pastebin REST API"
 # Create non-root user
 RUN groupadd -r flaskpaste && useradd -r -g flaskpaste flaskpaste
 
+# Copy virtual environment from builder
+COPY --from=builder /opt/venv /opt/venv
+ENV PATH="/opt/venv/bin:$PATH"
+
 # Set working directory
 WORKDIR /app
 
-# Install dependencies first (cache layer)
-COPY requirements.txt .
-RUN pip install --no-cache-dir -r requirements.txt gunicorn
-
-# Copy application code
+# Copy only necessary application files
 COPY app/ ./app/
 COPY wsgi.py .
 COPY fpaste .
 
-# Create data directory
+# Create data directory with correct ownership
 RUN mkdir -p /app/data && chown -R flaskpaste:flaskpaste /app
 
 # Switch to non-root user
@@ -32,6 +52,7 @@ USER flaskpaste
 ENV FLASK_ENV=production
 ENV FLASKPASTE_DB=/app/data/pastes.db
 ENV PYTHONUNBUFFERED=1
+ENV PYTHONDONTWRITEBYTECODE=1
 
 # Expose port
 EXPOSE 5000