feat(settings): CA generation from the UI; Routstr panel beside the API key

WebUI RULE (operator, 2026-08-14): never point users at a terminal. The
certificate section told users to run setup-node-ca.sh by hand — it now
has a Generate button backed by system.node-ca.generate, which runs the
idempotent script server-side (live-tested: generated and /ca.crt serves).
Routstr budget panel moves directly under the Claude API key card.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

neode-ui/src/views/settings/SystemSection.vue

@@ -16,8 +16,8 @@ import SystemDangerZone from '@/views/settings/SystemDangerZone.vue'
   <InterfaceModeSection />
   <KioskDisplaySection />
   <ClaudeAuthSection />
-  <AIDataAccessSection />
   <RoutstrBudgetSection />
+  <AIDataAccessSection />
   <WebhookSection />
   <TelemetrySection />
   <NodeCertificateSection />