test + docs: close 12 test gaps (~250 new tests) and expand testing guide to 34 parts

Implements all P0-P2 test gaps from docs/test-gap-prompt.md:
- Deployment service tests (20), target service tests (18), scheduler tests (8)
- Agent binary tests (48), CSR renewal tests (8), short-lived cert tests (7)
- Domain model tests (25), context cancellation tests (9), concurrency tests (7)
- Handler negative-path tests (23 across 5 files)
- Frontend error handling tests (86) and API client tests (7)

Expands testing-guide.md from 28 to 34 parts covering certificate export,
S/MIME/EKU, OCSP/DER CRL, body size limits, Apache/HAProxy connectors,
and sub-CA mode. Fixes stale profile count (4->5) and updates sign-off table.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/domain/job_test.go

@@ -0,0 +1,34 @@
+package domain
+
+import "testing"
+
+func TestJobType_Constants(t *testing.T) {
+	tests := map[string]JobType{
+		"Issuance":   JobTypeIssuance,
+		"Renewal":    JobTypeRenewal,
+		"Deployment": JobTypeDeployment,
+		"Validation": JobTypeValidation,
+	}
+	for expected, got := range tests {
+		if string(got) != expected {
+			t.Errorf("expected %q, got %q", expected, string(got))
+		}
+	}
+}
+
+func TestJobStatus_Constants(t *testing.T) {
+	tests := map[string]JobStatus{
+		"Pending":          JobStatusPending,
+		"AwaitingCSR":      JobStatusAwaitingCSR,
+		"AwaitingApproval": JobStatusAwaitingApproval,
+		"Running":          JobStatusRunning,
+		"Completed":        JobStatusCompleted,
+		"Failed":           JobStatusFailed,
+		"Cancelled":        JobStatusCancelled,
+	}
+	for expected, got := range tests {
+		if string(got) != expected {
+			t.Errorf("expected %q, got %q", expected, string(got))
+		}
+	}
+}