Add complete seed, Always Encrypted cert package, and TEST system DE-Test.

Co-authored-by: Cursor <cursoragent@cursor.com>

ZA.CoreService.ESBCertificateManager/Database/AlwaysEncrypted/Install-Certificate.ps1

@@ -0,0 +1,41 @@
+<#
+.SYNOPSIS
+    Importiert das Always-Encrypted-Zertifikat in CurrentUser\My.
+.NOTES
+    PFX-Passwort (nur Dev): ESB-AE-Dev-Only!
+    Thumbprint muss mit appsettings AlwaysEncrypted:CertificateThumbprint uebereinstimmen.
+#>
+$ErrorActionPreference = "Stop"
+
+$scriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path
+$pfxPath = Join-Path $scriptDir "ESB_ZertifikatManager_AE.pfx"
+$thumbPath = Join-Path $scriptDir "thumbprint.txt"
+
+if (-not (Test-Path $pfxPath)) {
+    throw "PFX nicht gefunden: $pfxPath"
+}
+
+$expectedThumb = (Get-Content -Path $thumbPath -Raw).Trim()
+$password = ConvertTo-SecureString -String "ESB-AE-Dev-Only!" -Force -AsPlainText
+
+$imported = Import-PfxCertificate `
+    -FilePath $pfxPath `
+    -CertStoreLocation "Cert:\CurrentUser\My" `
+    -Password $password `
+    -Exportable
+
+Write-Host "Zertifikat importiert:"
+Write-Host "  Subject    : $($imported.Subject)"
+Write-Host "  Thumbprint : $($imported.Thumbprint)"
+Write-Host "  PrivateKey : $($imported.HasPrivateKey)"
+
+if (-not [string]::Equals(
+        $imported.Thumbprint,
+        $expectedThumb,
+        [System.StringComparison]::OrdinalIgnoreCase)) {
+    Write-Warning "Thumbprint weicht von thumbprint.txt ab ($expectedThumb)."
+}
+
+Write-Host ""
+Write-Host "appsettings.json AlwaysEncrypted:CertificateThumbprint ="
+Write-Host $imported.Thumbprint