User manually imported bernd.rodler.p12 through the real Settings >
S/MIME > Import key dialog on localhost:3100 - real native file picker,
real PKCS#12 passphrase, real storage passphrase. Succeeded.
This closes the last unverified layer. Every step of the delivery path
is now proven end to end: crypto correctness, parser hardening against
hostile input, admin install, client activation under the B-04 gate,
and now UI key import.
Also fixes a stale line in the audit doc that still listed finding 5
as open after it was fixed in a4155aa3.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
