feat: sign what you write, with your signature, signature blocks and your own certificate

[FPurchess]

Sign what you write in Blank, visibly and with your own certificate. This is the first of three stacked PRs for signing; the PDF tabs (#123) and signing received PDFs (#124) build on it.

What users get

• Your signature and initials (Settings ▸ Signing, or the commands "Your signature…" / "Your initials…"):
  • Draw them, type them in one of four script fonts (Pinyon Script, Ms Madi, Dancing Script, Caveat), or use a picture, whose background is removed.
  • They're kept in <app config>/signing/.
• Signature blocks: a new Signing group in the blocks pane.
  • Each block is one signer, with a line, "Name · Role", and "Place, date".
  • Its settings (Role, Name, Place, Date, Width) are in its popover.
  • The block is saved as <!-- blank:signature@1 … -->, and makes the round trip through Word. A Word signature line becomes a block on import.
• Export signed PDF…:
  • The save dialog comes first, then the Sign dialog: Sign as, the block to sign, initials on every page, place, reason and the passphrase.
  • The PDF stays PDF/A-2u. "No digital signature" writes only the visible signature.
• Digital signatures:
  • Create a P-256 certificate (rcgen), or import a .p12. You can back up the key and export the certificate.
  • Signing is PAdES: CMS ETSI.CAdES.detached, signed as an incremental update with lopdf.
  • An RFC 3161 timestamp server is optional. When it fails, Blank offers to sign without it.
  • Trusted certificates are kept by their fingerprint.

How it works

• Engine: Content::Stamp lays out the block. The engine also reports the boxes of the blocks, so the signer knows where they sit. The wasm is rebuilt.
• Signer (src-tauri/src/signing/): the key, the CMS and the timestamp stay native, and the passphrase crosses IPC once per signing. The signer never rewrites earlier bytes.
• Rules and docs: .claude/rules/signing.md and docs/guide/signing.md, plus the blocks, settings, configuration and shortcuts pages.

Checked by hand

• Acrobat Reader: "validity unknown", then valid after adding the certificate to Trusted Identities
• LibreOffice and Okular list the signature, and EU DSS reports B-B / B-T