Deprecate Linked CA functionality

[tashian]

Summary

• Add deprecation warnings when Linked CA features are used
• Add step-ca export --token flag to export from linked CAs
• Add step-ca import command to import provisioners and admins into standalone CA
• Existing Linked CAs and Linked RAs continue to work but show warnings

Changes

Deprecation Warnings

• authority/authority.go: Warning when linkedCAToken is initialized
• commands/app.go: Warning when --token flag is used at startup
• CHANGELOG.md: Added deprecation notice

Migration Tools

• commands/export.go: Add --token flag to fetch provisioners/admins from linked CA cloud storage
• commands/import.go: New command to import provisioners and admins from export file into standalone CA database
  • Automatic ID remapping for provisioners and admins
  • Duplicate detection (skips existing provisioners by name, admins by subject)
  • --dry-run flag to preview changes without modifying the database

Migration Workflow

# 1. Export from linked CA (while CA is running)
step-ca export $(step path)/config/ca.json --token $STEP_CA_TOKEN > export.json

# 2. Stop the CA

# 3. Update ca.json:
#    - Remove the authority.linkedca section
#    - Ensure authority.enableAdmin: true
#    - Ensure db is configured

# 4. Import provisioners and admins
step-ca import $(step path)/config/ca.json export.json

# 5. Start the CA without --token
step-ca $(step path)/config/ca.json

Behavior Summary

Scenario	Before	After
step-ca --token=xxx (existing linked CA)	Works silently	Works but shows deprecation warning
step-ca --token=xxx (existing linked RA)	Works silently	Works but shows deprecation warning
step-ca export	Exports local config only	Can also export linked CA config with --token
step-ca import	N/A (new command)	Imports provisioners and admins from export file

Note: Changes to step ca init (removing the Linked option from the interactive menu and blocking --deployment-type=linked) are in the related CLI PR.

Context

This is phase 1 of removing Linked CA from open-source step-ca. The linked deployment type is moving to Step CA Pro.

• Release N (this PR): Add deprecation warnings, migration tools. Existing linked CAs and RAs continue to work.
• Release N+2 or N+3: Remove linked CA code entirely

Related CLI PR: smallstep/cli#1559

Test plan

• make build passes
• make test passes (4843 tests)
• make lint passes (no new issues)
• Manual test: step-ca --token=xxx shows deprecation warning but continues to work
• Manual test: step-ca export --token exports linked CA provisioners
• Manual test: step-ca import imports provisioners into standalone CA

🤖 Generated with Claude Code