test + docs: close 12 test gaps (~250 new tests) and expand testing guide to 34 parts

Implements all P0-P2 test gaps from docs/test-gap-prompt.md:
- Deployment service tests (20), target service tests (18), scheduler tests (8)
- Agent binary tests (48), CSR renewal tests (8), short-lived cert tests (7)
- Domain model tests (25), context cancellation tests (9), concurrency tests (7)
- Handler negative-path tests (23 across 5 files)
- Frontend error handling tests (86) and API client tests (7)

Expands testing-guide.md from 28 to 34 parts covering certificate export,
S/MIME/EKU, OCSP/DER CRL, body size limits, Apache/HAProxy connectors,
and sub-CA mode. Fixes stale profile count (4->5) and updates sign-off table.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/domain/notification_test.go

@@ -0,0 +1,73 @@
+package domain
+
+import "testing"
+
+func TestNotificationType_Constants(t *testing.T) {
+	tests := map[string]NotificationType{
+		"ExpirationWarning": NotificationTypeExpirationWarning,
+		"RenewalSuccess":    NotificationTypeRenewalSuccess,
+		"RenewalFailure":    NotificationTypeRenewalFailure,
+		"DeploymentSuccess": NotificationTypeDeploymentSuccess,
+		"DeploymentFailure": NotificationTypeDeploymentFailure,
+		"PolicyViolation":   NotificationTypePolicyViolation,
+		"Revocation":        NotificationTypeRevocation,
+	}
+	for expected, got := range tests {
+		if string(got) != expected {
+			t.Errorf("expected %q, got %q", expected, string(got))
+		}
+	}
+}
+
+func TestNotificationChannel_Constants(t *testing.T) {
+	tests := map[string]NotificationChannel{
+		"Email":     NotificationChannelEmail,
+		"Webhook":   NotificationChannelWebhook,
+		"Slack":     NotificationChannelSlack,
+		"Teams":     NotificationChannelTeams,
+		"PagerDuty": NotificationChannelPagerDuty,
+		"OpsGenie":  NotificationChannelOpsGenie,
+	}
+	for expected, got := range tests {
+		if string(got) != expected {
+			t.Errorf("expected %q, got %q", expected, string(got))
+		}
+	}
+}
+
+func TestNotificationEvent_Fields(t *testing.T) {
+	// This test verifies the NotificationEvent struct can be instantiated
+	// with all expected fields.
+	certID := "mc-123"
+	errorMsg := "failed to send"
+	event := &NotificationEvent{
+		ID:            "notif-1",
+		Type:          NotificationTypeExpirationWarning,
+		CertificateID: &certID,
+		Channel:       NotificationChannelSlack,
+		Recipient:     "alerts@example.com",
+		Message:       "Certificate expiring in 30 days",
+		Status:        "sent",
+		Error:         &errorMsg,
+	}
+
+	if event.ID != "notif-1" {
+		t.Errorf("expected ID 'notif-1', got %s", event.ID)
+	}
+
+	if event.Type != NotificationTypeExpirationWarning {
+		t.Errorf("expected type ExpirationWarning, got %s", string(event.Type))
+	}
+
+	if event.Channel != NotificationChannelSlack {
+		t.Errorf("expected channel Slack, got %s", string(event.Channel))
+	}
+
+	if event.CertificateID == nil || *event.CertificateID != "mc-123" {
+		t.Errorf("expected CertificateID mc-123, got %v", event.CertificateID)
+	}
+
+	if event.Error == nil || *event.Error != "failed to send" {
+		t.Errorf("expected error 'failed to send', got %v", event.Error)
+	}
+}