docs: add tenant CA cert management to CLAUDE.md and HOWTO.md

- TenantCaCertEntity, TenantCaCertRepository, TenantCaCertService
- TenantPortalController CA endpoints
- V013 migration
- Tenant portal API reference updated

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

HOWTO.md

@@ -341,6 +341,10 @@ Query params: `since`, `until` (ISO timestamps), `limit` (default 500), `stream`
 | GET | `/api/tenant/settings` | Tenant settings |
 | GET | `/api/tenant/sso` | List SSO connectors |
 | POST | `/api/tenant/sso` | Create SSO connector |
+| GET | `/api/tenant/ca` | List tenant CA certificates |
+| POST | `/api/tenant/ca` | Upload CA cert (staged) |
+| POST | `/api/tenant/ca/{id}/activate` | Activate staged CA cert |
+| DELETE | `/api/tenant/ca/{id}` | Remove CA cert |
 | GET | `/api/tenant/audit` | Tenant audit log |
 
 ### Health