Shared on-demand signing context. Holds the persistent revocation sources
(DogtagSync retains a sync cookie — must be shared, not rebuilt each pass)
behind a mutex that serializes on-demand signing (admin API) against the
background signer loop, so epoch derivation (from the state store) and
{label}.ahu writes never interleave.
Build the standalone admin router (admin API + web UI) for a dedicated
management listener. Contains no OCSP routes, so it can be TLS-terminated
independently of the plaintext OCSP data plane.