certificate: say where it comes from, offer import alongside download, keep cert files out of the repo

.gitignore

@@ -31,3 +31,10 @@ CLAUDE.md
 archive/
 .wrangler/
 stats-worker/
+
+# Certificates and keys never go in the repo; the app downloads or imports them on the phone.
+*.p12
+*.pfx
+*.pem
+*.crt
+*.key