feat: HSM main/slave certificate comparison with batch SQL generation

- compare usercert_tab by subject raw bytes + certtype
- generate single annotated CSV report
- generate merge-<timestamp>.sql in current directory for DBA execution
- preserve GBK DN bytes via ATTACH + INSERT OR REPLACE / UPDATE
- compatible with sqlite3 3.6.20 and JDK 1.8

scripts/test-data-main.sql

@@ -0,0 +1,27 @@
+-- 在主库中增加 3 条用于测试“不一致”的证书。
+-- 与 slave-test-data.sql 配合：同一 DN + certtype 在两边都存在，但字段不同。
+-- 执行前请备份 main.db。
+
+-- 1) SN 不一致：main=0A0B0C01 / slave=0A0B0C11
+INSERT INTO usercert_tab
+  (organid, subject, issuer, sn, pubkey_alg, pubkey, sign_alg, signinfo,
+   not_before, not_after, certfile, certtype, opertime, stat)
+SELECT organid, 'CN=diff-sn-01', issuer, '0A0B0C01', pubkey_alg, pubkey, sign_alg, signinfo,
+       '20260101000000', '20301231235959', certfile, 0, opertime, 0
+FROM usercert_tab ORDER BY rowid LIMIT 1;
+
+-- 2) 有效期不一致：main 失效 2030 / slave 失效 2031
+INSERT INTO usercert_tab
+  (organid, subject, issuer, sn, pubkey_alg, pubkey, sign_alg, signinfo,
+   not_before, not_after, certfile, certtype, opertime, stat)
+SELECT organid, 'CN=diff-time-02', issuer, '0A0B0C02', pubkey_alg, pubkey, sign_alg, signinfo,
+       '20260101000000', '20301231235959', certfile, 2, opertime, 0
+FROM usercert_tab ORDER BY rowid LIMIT 1;
+
+-- 3) 状态不一致：main stat=0 / slave stat=1
+INSERT INTO usercert_tab
+  (organid, subject, issuer, sn, pubkey_alg, pubkey, sign_alg, signinfo,
+   not_before, not_after, certfile, certtype, opertime, stat)
+SELECT organid, 'CN=diff-stat-03', issuer, '0A0B0C03', pubkey_alg, pubkey, sign_alg, signinfo,
+       '20260101000000', '20301231235959', certfile, 5, opertime, 0
+FROM usercert_tab ORDER BY rowid LIMIT 1;