test + docs: close 12 test gaps (~250 new tests) and expand testing guide to 34 parts

Implements all P0-P2 test gaps from docs/test-gap-prompt.md:
- Deployment service tests (20), target service tests (18), scheduler tests (8)
- Agent binary tests (48), CSR renewal tests (8), short-lived cert tests (7)
- Domain model tests (25), context cancellation tests (9), concurrency tests (7)
- Handler negative-path tests (23 across 5 files)
- Frontend error handling tests (86) and API client tests (7)

Expands testing-guide.md from 28 to 34 parts covering certificate export,
S/MIME/EKU, OCSP/DER CRL, body size limits, Apache/HAProxy connectors,
and sub-CA mode. Fixes stale profile count (4->5) and updates sign-off table.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/api/handler/export_handler_test.go

@@ -12,6 +12,8 @@ import (
 	"github.com/shankar0123/certctl/internal/service"
 )
 
+// Add context import was already there — verify import is present above
+
 // MockExportService is a mock implementation of ExportService interface.
 type MockExportService struct {
 	ExportPEMFn    func(ctx context.Context, certID string) (*service.ExportPEMResult, error)
@@ -280,3 +282,38 @@ func TestExtractCertIDFromExportPath(t *testing.T) {
 		}
 	}
 }
+
+func TestExportPKCS12_InvalidJSON(t *testing.T) {
+	mockSvc := &MockExportService{
+		ExportPKCS12Fn: func(_ context.Context, _ string, password string) ([]byte, error) {
+			// Invalid JSON is silently ignored, defaults to empty password
+			if password != "" {
+				t.Errorf("expected empty password (invalid JSON ignored), got %s", password)
+			}
+			return []byte{0x30}, nil
+		},
+	}
+	h := NewExportHandler(mockSvc)
+
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/certificates/mc-test-1/export/pkcs12", strings.NewReader(`{"invalid json`))
+	w := httptest.NewRecorder()
+
+	h.ExportPKCS12(w, req)
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("expected 200 (invalid JSON ignored), got %d", w.Code)
+	}
+}
+
+func TestExportPEM_MethodNotAllowedDelete(t *testing.T) {
+	h := NewExportHandler(&MockExportService{})
+
+	req := httptest.NewRequest(http.MethodDelete, "/api/v1/certificates/mc-test-1/export/pem", nil)
+	w := httptest.NewRecorder()
+
+	h.ExportPEM(w, req)
+
+	if w.Code != http.StatusMethodNotAllowed {
+		t.Fatalf("expected 405, got %d", w.Code)
+	}
+}