feat(switch-controller): add ConfigureCertificate phase with RMS job polling

     Extend the switch Configuring state machine with a certificate configuration
     sub-flow that runs after RotateOsPassword and before Validating. The handler
     submits an async RMS job via Component Manager and polls until completion.

        State machine (api-model):
        - Add ConfigureCertificateState { Start, WaitForComplete { job_id } }
        - Nest under ConfiguringState::ConfigureCertificate
        - RotateOsPassword now transitions into ConfigureCertificate(Start)

        Switch handler (configuring.rs):
        - Start: derive cert_name from switch.rack_id; build SwitchEndpoint from BMC
          MAC, NVOS interface, and vault credentials; call CM to start the job
        - WaitForComplete: poll CM for ConfigureSwitchCertificateState until Completed
          (→ Validating), Failed (→ Error), or in-progress (wait)
        - Skip certificate configuration when rack_id or component manager is absent

        Component Manager:
        - Expose configure_switch_certificate(endpoint, cert_name) → job_id
        - Expose get_configure_switch_certificate_job_status(job_id) → job status
        - Extend NvSwitchManager; implement in mock (configurable job status), NSM
          (unsupported), and RmsBackend (stub until librms RPCs land)
        - Add ConfigureSwitchCertificateState { Started, InProgress, Completed, Failed }

        Tests:
        - Integration tests for skip paths, Start → WaitForComplete, success/failure
          polling, and RotateOsPassword → ConfigureCertificate(Start)
        - Test fixtures for rack_id assignment and versioned state transitions

        Docs:
        - Add switch_configure_certificate.md with FSM detail and RMS sequence diagrams
        - Update switch.md transitions and link to the new design doc

Signed-off-by: Vinod Chitrali <vchitrali@nvidia.com>

Author: vinodchitraliNVIDIA

Cargo.lock

@@ -27,7 +27,7 @@ authors = ["NVIDIA Carbide Engineering <carbide-dev@exchange.nvidia.com>"]
 [workspace.dependencies]
 clap = { version = "4", features = ["derive", "env"] }
 libredfish = { git = "https://github.com/NVIDIA/libredfish.git", tag = "v0.44.11" }
-librms = { git = "https://github.com/NVIDIA/nv-rms-client.git", tag = "v0.9.0-rc1" }
+librms = { git = "https://github.com/NVIDIA/nv-rms-client.git", tag = "v0.9.0-mts-rc03" }
 ansi-to-html = "0.2.2"
 
 tokio = { version = "1", features = ["full", "tracing"] }

Cargo.toml

@@ -15,8 +15,10 @@
  * limitations under the License.
  */
 
+use carbide_uuid::rack::RackId;
 use carbide_uuid::switch::SwitchId;
-use model::switch::SwitchControllerState;
+use db::switch as db_switch;
+use model::switch::{ConfigureCertificateState, ConfiguringState, SwitchControllerState};
 use sqlx::PgConnection;
 
 /// Helper function to set switch controller state directly in database
@@ -34,6 +36,56 @@ pub async fn set_switch_controller_state(
     Ok(())
 }
 
+pub async fn set_switch_rack_id(
+    txn: &mut PgConnection,
+    switch_id: &SwitchId,
+    rack_id: &RackId,
+) -> Result<(), sqlx::Error> {
+    sqlx::query("UPDATE switches SET rack_id = $1 WHERE id = $2")
+        .bind(rack_id)
+        .bind(switch_id)
+        .execute(txn)
+        .await?;
+    Ok(())
+}
+
+pub async fn transition_switch_controller_state(
+    txn: &mut PgConnection,
+    switch_id: &SwitchId,
+    new_state: SwitchControllerState,
+) -> Result<(), Box<dyn std::error::Error>> {
+    let switch = db_switch::find_by_id(txn, switch_id)
+        .await?
+        .expect("switch should exist");
+    db_switch::try_update_controller_state(
+        txn,
+        *switch_id,
+        switch.controller_state.version,
+        switch.controller_state.version.increment(),
+        &new_state,
+    )
+    .await?;
+    Ok(())
+}
+
+pub fn configure_certificate_start_state() -> SwitchControllerState {
+    SwitchControllerState::Configuring {
+        config_state: ConfiguringState::ConfigureCertificate {
+            configure_certificate: ConfigureCertificateState::Start,
+        },
+    }
+}
+
+pub fn configure_certificate_wait_state(job_id: &str) -> SwitchControllerState {
+    SwitchControllerState::Configuring {
+        config_state: ConfiguringState::ConfigureCertificate {
+            configure_certificate: ConfigureCertificateState::WaitForComplete {
+                job_id: job_id.to_string(),
+            },
+        },
+    }
+}
+
 /// Helper function to mark switch as deleted
 pub async fn mark_switch_as_deleted(
     txn: &mut PgConnection,