feat: M15a — certificate revocation API, CRL endpoint, and revocation notifications

Implements core revocation infrastructure: POST /api/v1/certificates/{id}/revoke
with all 8 RFC 5280 reason codes, JSON-formatted CRL at GET /api/v1/crl, webhook
and email revocation notifications, best-effort issuer notification, and immutable
revocation audit trail. Includes 48 new tests across service, handler, integration,
and domain layers (600+ total). Fixes 3 pre-existing test bugs (team_test error
matching, agent_group delete status code, team handler per_page validation).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/domain/certificate.go

@@ -22,6 +22,8 @@ type ManagedCertificate struct {
 	Tags                 map[string]string `json:"tags"`
 	LastRenewalAt        *time.Time        `json:"last_renewal_at,omitempty"`
 	LastDeploymentAt     *time.Time        `json:"last_deployment_at,omitempty"`
+	RevokedAt            *time.Time        `json:"revoked_at,omitempty"`
+	RevocationReason     string            `json:"revocation_reason,omitempty"`
 	CreatedAt            time.Time         `json:"created_at"`
 	UpdatedAt            time.Time         `json:"updated_at"`
 }