docs: fix modutil/P11_KIT_SERVER_ADDRESS ordering in PKCS#11 guide

[joshdrake]

Problem

The OpenSSL and PKCS#11 support section of the Smallstep Agent docs showed a broken command sequence: it ran modutil -add before exporting P11_KIT_SERVER_ADDRESS.

This fails. modutil loads and initializes the module as part of adding it, and p11-kit-client.so cannot initialize unless P11_KIT_SERVER_ADDRESS already points at the running agent's PKCS#11 socket. Run in the documented order, modutil errors out and can leave a broken module registered in ~/.pki/nssdb.

Changes

• platform/smallstep-agent.mdx — Export P11_KIT_SERVER_ADDRESS before running modutil, and add a warning callout explaining the ordering requirement (with a deep link to the new recovery steps).
• platform/troubleshooting-agent.mdx — Add a Recovering from a failed modutil add subsection: close the browser, list modules (modutil -list / certutil -d ~/.pki/nssdb -U), delete the broken module (modutil -delete step-agent), then re-export and re-add in the correct order.
• .vale/styles/config/vocabularies/Smallstep/accept.txt — Accept certutil (matches how modutil is already whitelisted).

Verification

• vale (repo config, excluding auto-generated step-cli/reference/**): the edits introduce no new lint errors.
• New anchor #recovering-from-a-failed-modutil-add and reused #openssl-and-pkcs11-support follow the repo's slug convention.
• Full end-to-end command testing requires a running agent exposing the PKCS#11 socket (not available in the docs environment); the command flow is verified against p11-kit/NSS behavior and a firsthand report of the failure.

🤖 Generated with Claude Code

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}