refactor!: rename to cryptos-manager and own the fleet API protos

[Bugs5382]

What and why

The repository is now CryptOS-PKI/cryptos-manager (renamed on GitHub; the old URLs redirect). This PR moves everything to the new name and makes the manager own the API it serves.

• Module path: github.com/CryptOS-PKI/manager becomes github.com/CryptOS-PKI/cryptos-manager.
• Fleet API protos move in from api to proto/cryptos/fleet/v1. The package stays cryptos.fleet.v1, so the web's Connect paths don't change. The Go, gRPC and connect-go stubs are generated under gen/go/cryptos/fleet/v1 with the plugin versions api pinned.
• The node API comes from cryptos-node: go.mod pins github.com/CryptOS-PKI/cryptos-node at the merge commit of refactor!: rename to cryptos-node and own the node API protos cryptos-node#342 (8d8b52d). task proto:deps copies that version's proto/ into .deps/ so buf resolves the fleet protos' imports, and the generated fleet code imports the node stubs from cryptos-node. The node types move from cryptos.v1 to cryptos.node.v1, so the manager now calls nodes at /cryptos.node.v1.NodeService/..., which matches cryptos-node main. api is no longer required.
• Tooling and CI: task tools, proto:deps, proto:lint, proto:breaking, generate and generate:verify. task ci and Go CI lint the protos and fail when gen/ is stale, and Go CI installs a checksum-pinned buf.
• Tests: the api repo's fleet contract tests move to internal/apiconformance. The existing nodeclient and wire round-trip tests now build against the cryptos-node stubs.
• Image: the release image is ghcr.io/cryptos-pki/cryptos-manager. The chart default, the compose file, the Dockerfile source label and the docs all use it.
• Docs: README (name, a Fleet API section, companion repos), AGENTS (the pin to keep current is now cryptos-node), the CLAUDE title and repo path, and the deploying-standalone guide.

The web checkout references (CryptOS-PKI/web in the image workflows and the Dockerfile's web/ layout) stay as they are. They change with the cryptos-web monorepo PR.

Breaking: the module path, the stub import paths, the node package and the image name. Nothing is tagged yet. buf breaking is re-baselined at this PR.

Refs CryptOS-PKI/cryptos-node#336

Verification

• Lint clean
• Tests pass
• Build succeeds
• Documentation updated (if behavior or API changed)

How this was verified

• task ci passes locally against Postgres 18 (MANAGER_TEST_DATABASE_URL set): gofmt, buf lint and format, the generated-code check, vet, golangci-lint and the full test suite. task build passes too.
• The moved fleet protos match api once the import paths, go_package and node package references are normalised.
• grep -rnE 'CryptOS-PKI/(api|cryptos|manager)([^-]|$)' has one hit outside the CHANGELOG, a deliberate history note naming api#110 in a contract test.

[Bugs5382]

Closing summary: the repo is renamed to cryptos-manager and the module path follows. The fleet API protos now live in proto/cryptos/fleet/v1 (package unchanged), with Go, gRPC and connect-go stubs under gen/go/cryptos/fleet/v1. The node API comes from cryptos-node at 8d8b52d, through task proto:deps and the cryptos-node stubs, and the api dependency is gone. task ci and Go CI check the protos and gen/. The image name is now ghcr.io/cryptos-pki/cryptos-manager. The PR hygiene check skips generated code, as api's did. All checks are green.