docs: add AIT-73927 cert rotator recovery guide

[timonwong]

Summary

• Add bilingual internal KB guidance for recovering node-local Kubernetes certificates after cluster-cert-rotator issued short-lived certificates.
• Document CA-bounded duration selection, delivered cert-renew image usage, backups, node-local scope, restart impact, verification, and rollback.
• Keep the procedure explicitly emergency-only; it does not rotate or extend the CA.

Review focus

• Confirm the intended control-plane/worker scope and CA-key handling for field operations.
• Confirm the etcd restart or certificate-reload expectation before publishing.
• The ACP live-cluster run remains to be performed after the procedure is approved.