Document Linux CA install: system store + manual browser import

- SECURITY.md: Note that we install to system store and run
  update-ca-certificates; add that Chrome/Firefox may not use it.
- Add step-by-step instructions to manually import the CA into
  Chrome/Chromium and Firefox on Linux (path to ca.cert.pem).
- INSTALLATION.md: In first-time setup, add Linux note and link
  to SECURITY.md for manual import.

docs/INSTALLATION.md

@@ -167,7 +167,7 @@ After loading the extension:
 4. Go to **Virtual Hosts** → add a hostname (e.g. `myapp.hole.sail`) and its `hs://` key
 5. Navigate to `https://myapp.hole.sail/`
 
-> The root CA must be installed and Chrome must be restarted before `*.hole.sail` sites will load without a certificate warning. The CA is installed silently to your user keychain — no admin password is required on macOS.
+> The root CA must be installed and Chrome must be restarted before `*.hole.sail` sites will load without a certificate warning. The CA is installed silently to your user keychain — no admin password is required on macOS. On Linux, the CA is installed into the system store and the certificate cache is updated; Chrome or Firefox may still require you to [import the CA manually](SECURITY.md#installation) into the browser's certificate store — see **Linux: Chrome and Firefox** in [Security](SECURITY.md#installation).
 
 ---
 

docs/SECURITY.md

@@ -50,6 +50,11 @@ Certificates are generated on the first HTTPS connection to a new wildcard paren
 
 On macOS, the CA is installed to the user's login keychain with the SSL trust policy. Chrome evaluates TLS trust using the SSL policy against all user keychains, so this is sufficient without admin privileges.
 
+**Linux:** The installer copies the root CA to `/usr/local/share/ca-certificates/holesail-browser-ca.crt` and runs `update-ca-certificates`, so the system trust store is updated. Chrome and Firefox on Linux often use their own certificate stores and may **not** automatically pick up the system store. If `*.hole.sail` (or other virtual host domains) still show certificate errors after installing the CA from the dashboard, import the CA into your browser manually:
+
+- **Chrome / Chromium:** Open **Settings** → **Privacy and security** → **Security** → **Manage certificates** (or go to `chrome://settings/certificates`). Open the **Authorities** tab → **Import** → select the CA file at `~/.holesail-browser/holesail-browser-certs/ca.cert.pem`. Ensure **Trust this certificate for identifying websites** is checked → **OK**. Restart Chrome.
+- **Firefox:** Open **Settings** → **Privacy & Security** → scroll to **Certificates** → **View Certificates**. In the **Authorities** tab → **Import** → select `~/.holesail-browser/holesail-browser-certs/ca.cert.pem`. Check **Trust this CA to identify websites** → **OK**. Restart Firefox if needed.
+
 ---
 
 ## P2P encryption