Implement documented-but-missing Admin API endpoints (upstreams, PKI, @id, Etag)

[gsmlg]

Problem

The moduledoc on Caddy.Admin.Api.api/0 lists endpoints that have no implementation:

• GET /reverse_proxy/upstreams — upstream health/status. For a reverse-proxy manager this is arguably the most important observability endpoint.
• GET /pki/ca/<id> and GET /pki/ca/<id>/certificates — CA and cert chain inspection
• @id-based config traversal (/id/...) — the ergonomic way to mutate deep config
• Etag/If-Match concurrent-change protection — without it, apply_runtime_config can race with other admin clients

Proposal

Add wrappers in Caddy.Admin.Api (and typed helpers in Caddy.Admin.Resources where it fits), e.g.:

{:ok, upstreams} = Caddy.Admin.Api.get_upstreams()
{:ok, ca} = Caddy.Admin.Api.get_pki_ca("local")
{:ok, config} = Caddy.Admin.Api.get_by_id("my_route")