Expose internal CA bundle endpoint

[jamestexas]

Summary

• add a host-agnostic GET /internal/ca-bundle route for cloister service-binding fetches
• share CABundle cache/bootstrap logic with /cert/gha
• cover cached, generated, malformed-cache, method, and authority-failure behavior

Verification

• pnpm --dir worker exec vitest run src/tests/internal-ca-bundle.test.ts
• pnpm --dir worker run build:local
• pnpm --dir worker test