test + docs: close 12 test gaps (~250 new tests) and expand testing guide to 34 parts

Implements all P0-P2 test gaps from docs/test-gap-prompt.md:
- Deployment service tests (20), target service tests (18), scheduler tests (8)
- Agent binary tests (48), CSR renewal tests (8), short-lived cert tests (7)
- Domain model tests (25), context cancellation tests (9), concurrency tests (7)
- Handler negative-path tests (23 across 5 files)
- Frontend error handling tests (86) and API client tests (7)

Expands testing-guide.md from 28 to 34 parts covering certificate export,
S/MIME/EKU, OCSP/DER CRL, body size limits, Apache/HAProxy connectors,
and sub-CA mode. Fixes stale profile count (4->5) and updates sign-off table.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/domain/certificate_test.go

@@ -0,0 +1,80 @@
+package domain
+
+import "testing"
+
+func TestCertificateStatus_Constants(t *testing.T) {
+	tests := map[string]CertificateStatus{
+		"Pending":             CertificateStatusPending,
+		"Active":              CertificateStatusActive,
+		"Expiring":            CertificateStatusExpiring,
+		"Expired":             CertificateStatusExpired,
+		"RenewalInProgress":   CertificateStatusRenewalInProgress,
+		"Failed":              CertificateStatusFailed,
+		"Revoked":             CertificateStatusRevoked,
+		"Archived":            CertificateStatusArchived,
+	}
+	for expected, got := range tests {
+		if string(got) != expected {
+			t.Errorf("expected %q, got %q", expected, string(got))
+		}
+	}
+}
+
+func TestDefaultAlertThresholds(t *testing.T) {
+	defaults := DefaultAlertThresholds()
+	expected := []int{30, 14, 7, 0}
+	if len(defaults) != len(expected) {
+		t.Errorf("expected %d thresholds, got %d", len(expected), len(defaults))
+	}
+	for i, v := range expected {
+		if i >= len(defaults) {
+			break
+		}
+		if defaults[i] != v {
+			t.Errorf("threshold[%d]: expected %d, got %d", i, v, defaults[i])
+		}
+	}
+}
+
+func TestRenewalPolicy_EffectiveAlertThresholds_Custom(t *testing.T) {
+	policy := &RenewalPolicy{
+		AlertThresholdsDays: []int{60, 30, 14, 7},
+	}
+	result := policy.EffectiveAlertThresholds()
+	if len(result) != 4 {
+		t.Errorf("expected 4 thresholds, got %d", len(result))
+	}
+	if result[0] != 60 {
+		t.Errorf("expected first threshold 60, got %d", result[0])
+	}
+}
+
+func TestRenewalPolicy_EffectiveAlertThresholds_Default(t *testing.T) {
+	policy := &RenewalPolicy{
+		AlertThresholdsDays: []int{},
+	}
+	result := policy.EffectiveAlertThresholds()
+	expected := DefaultAlertThresholds()
+	if len(result) != len(expected) {
+		t.Errorf("expected %d thresholds, got %d", len(expected), len(result))
+	}
+	for i, v := range expected {
+		if i >= len(result) {
+			break
+		}
+		if result[i] != v {
+			t.Errorf("threshold[%d]: expected %d, got %d", i, v, result[i])
+		}
+	}
+}
+
+func TestRenewalPolicy_EffectiveAlertThresholds_Nil(t *testing.T) {
+	policy := &RenewalPolicy{
+		AlertThresholdsDays: nil,
+	}
+	result := policy.EffectiveAlertThresholds()
+	expected := DefaultAlertThresholds()
+	if len(result) != len(expected) {
+		t.Errorf("expected %d thresholds, got %d", len(expected), len(result))
+	}
+}