[beppler]

Adds devca issue ca NAME [-d DOMAIN]... [-n NETWORK]..., which issues a subordinate certificate authority signed by the authority in the working directory (ca.crt/ca.key). It takes the same name-constraint flags as init, but the name is required.

The subordinate authority:

• is valid for 5 years and gets a key on the same curve as its parent;
• has CertSign/CRLSign key usage and pathlen 0, so it can issue server and code signing certificates but not other authorities;
• mirrors the init name constraints, including the rule that a domains-only authority excludes every IP range;
• fails fast when the requested domains/networks fall outside the parent's name constraints (RFC 5280 requires subordinate permitted subtrees to nest within the parent's), when the signer is not a CA, or when the signer itself has pathlen 0.

It writes name-serial.crt/name-serial.key like the other issue commands. To issue certificates with it, copy its files to a new directory as ca.crt/ca.key and run devca issue server or devca issue codesign there; the README documents the workflow.

Implementation notes:

• internal/ca/ca.go: IssueCertificateAuthority lives next to NewCertificateAuthority and both share the excluded-networks rule.
• internal/ca/constraints.go: name-constraint knowledge in one place (excluded ranges and RFC 5280 nesting validation).
• internal/ca/issue.go: signing core extracted into sign; the leaf issue path still forces IsCA = false.
• devca.go: new caCommand; parseNetworks helper shared by init and issue ca.
• Certificate validity durations are named constants (includes a small drive-by refactor of the pre-existing server, code signing and root durations).

Tests cover the happy path (including full chain verification through the subordinate with x509.Verify), constraint acceptance and rejection, excluded IP ranges, missing name, non-CA signer, pathlen-0 signer, expiring parent, and the constraint helpers. The chain was also verified end-to-end with openssl verify.