fpaste: add register command for public certificate enrollment

- Add register command to obtain client cert from server
- Solve PoW challenge, receive PKCS#12 bundle
- Extract cert/key, optionally update config (--configure)
- Fix registration to work without PKI_ENABLED (only needs PKI_CA_PASSWORD)
- Add skip_enabled_check param to get_ca_info() for registration path
- Update docs: README examples, API header name fix (X-Fingerprint-SHA1)

documentation/api.md

@@ -1119,7 +1119,8 @@ Content-Type: application/json
 |--------|-------------|
 | `X-Fingerprint-SHA1` | SHA1 fingerprint for `X-SSL-Client-SHA1` header |
 | `X-Certificate-Expires` | Unix timestamp when certificate expires |
-- Client certificate (signed by CA)
+
+**PKCS#12 Bundle Contents:**
 - Client certificate (signed by CA)
 - Client private key (EC secp384r1)
 - CA certificate (for trust chain)
@@ -1127,7 +1128,8 @@ X-Certificate-Fingerprint: b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3
 **Errors:**
 | Code | Description |
 |------|-------------|
-| 400 | Proof-of-work failed (invalid/expired challenge) |
+| 400 | Proof-of-work required (when enabled) |
+| 400 | Proof-of-work failed (invalid/expired challenge) |
 | 500 | PKI_CA_PASSWORD not configured |
 | 500 | Certificate generation failed |