feat: S/MIME certificate support in integration tests + test env docs

Add S/MIME (emailProtection EKU) end-to-end test coverage:
- ValidateCommonName() now accepts email addresses for S/MIME certs
- S/MIME test profile (prof-test-smime) in seed data
- Phase 11 test: issuance, EKU, KeyUsage, email SAN verification
- EST config enabled in test Docker Compose
- Portable KeyUsage parsing (awk, works on BSD/GNU)
- Full test environment documentation (docs/test-env.md)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

deploy/docker-compose.test.yml

@@ -190,6 +190,10 @@ services:
       CERTCTL_STEPCA_PASSWORD: password123
       CERTCTL_STEPCA_KEY_PATH: /stepca-data/secrets/provisioner_key
 
+      # EST server (RFC 7030) — uses Local CA by default
+      CERTCTL_EST_ENABLED: "true"
+      CERTCTL_EST_ISSUER_ID: iss-local
+
       # Network scanning
       CERTCTL_NETWORK_SCAN_ENABLED: "true"