certificate: say where it comes from, offer import alongside download, keep cert files out of the repo

.gitignore

@@ -30,4 +30,11 @@ CLAUDE.md
 # Other
 archive/
 .wrangler/
-stats-worker/
+stats-worker/
+
+# Certificates and keys never go in the repo; the app downloads or imports them on the phone.
+*.p12
+*.pfx
+*.pem
+*.crt
+*.key