refactor(scep-gui): rebrand SCEP admin surface to per-profile tabbed interface (Profiles + Intune + Recent Activity)

Phase 9 follow-up to the SCEP RFC 8894 + Intune master bundle. The
Phase 9.4 GUI shipped 'SCEP Intune Monitoring' at /scep/intune, which
made the per-profile observability surface look Intune-only — operators
running EJBCA + Jamf would never click that nav link expecting per-
profile RA cert + mTLS observability. The page is per-profile keyed
under the hood; this commit rebrands + restructures so the surface
matches what operators actually need.

Spec: cowork/scep-gui-restructure-prompt.md.

User-visible change:

  - Nav link renamed: 'SCEP Intune' → 'SCEP Admin'.
  - Route: /scep is the new canonical path; /scep/intune kept as a
    backward-compat alias that lands directly on the Intune tab.
  - Page header: 'SCEP Administration'.
  - Three tabs:
      * Profiles (default) — per-profile lean cards with RA cert
        expiry countdown, mTLS sibling-route status badge, Intune
        enabled/disabled badge, challenge-password-set indicator.
        'View Intune details →' link on Intune-enabled cards
        deep-links into the Intune tab.
      * Intune Monitoring — the existing Phase 9.4 deep-dive
        (per-status counters, trust anchor expiry, recent failures
        table, reload-trust button + confirmation modal).
      * Recent Activity — full SCEP audit log filter merging all
        four action codes (scep_pkcsreq + scep_renewalreq +
        scep_pkcsreq_intune + scep_renewalreq_intune); chip filters
        for All / Initial / Renewal / Intune / Static.

Backend:

  * internal/service/scep.go — new SCEPProfileStatsSnapshot type +
    IntuneSection sub-block + ProfileStats(now) accessor. Adds
    raCertSubject/raCertNotBefore/raCertNotAfter + mtlsEnabled +
    mtlsTrustBundlePath fields with SetRACert + SetMTLSConfig setters.
    Existing IntuneStatsSnapshot + IntuneStats(now) preserved
    UNCHANGED for /admin/scep/intune/stats backward compat (the
    JSON shape stays byte-stable for external consumers — the
    aliasing approach the prompt initially suggested doesn't work
    because the new shape nests Intune while the old one is flat).
    ChallengePasswordSet is derived from challengePassword != ''
    (the secret value itself is never surfaced).

  * internal/api/handler/admin_scep_intune.go — new Profiles handler
    method on AdminSCEPIntuneHandler with the same M-008 admin gate.
    AdminSCEPIntuneServiceImpl extended (in place; same
    map[string]*service.SCEPService) to satisfy the new
    AdminSCEPProfileService interface. Single handler file gets the
    third method so the M-008 pin entry count stays steady (no new
    file, no new triplet of admin-gate test files — just three new
    Profiles tests inside the existing test file).

  * internal/api/router/router.go — one new route
    'GET /api/v1/admin/scep/profiles' registered to
    reg.AdminSCEPIntune.Profiles. HandlerRegistry unchanged.

  * api/openapi.yaml — new operation 'listSCEPProfiles' documenting
    the request body / response shape / error mapping. Existing
    Intune entries unchanged.

  * cmd/server/main.go — per-profile loop now calls
    scepService.SetMTLSConfig(profile.MTLSEnabled,
    profile.MTLSClientCATrustBundlePath) right after SetPathID, and
    scepService.SetRACert(raCert) right after loadSCEPRAPair returns
    the leaf cert. Both setters are nil-safe.

  * internal/api/handler/m008_admin_gate_test.go — extended the
    existing admin_scep_intune.go entry's justification to mention
    the third endpoint. No new map entry needed (file already
    listed).

Backend tests (8 new):

  * TestAdminSCEPProfiles_NonAdmin_Returns403
  * TestAdminSCEPProfiles_AdminExplicitFalse_Returns403
  * TestAdminSCEPProfiles_AdminPermitted_ForwardsActor — also pins
    that Intune-enabled profiles emit an 'intune' sub-block while
    Intune-disabled profiles OMIT it.
  * TestAdminSCEPProfiles_RejectsNonGetMethod
  * TestAdminSCEPProfiles_PropagatesServiceError
  * TestAdminSCEPProfilesServiceImpl_NilMapReturnsEmpty
  * (existing 16 Phase 9 admin tests still pass — backward-compat
    preserved)

Frontend:

  * web/src/api/types.ts — new SCEPProfileStatsSnapshot +
    IntuneSection + SCEPProfilesResponse types. Existing
    IntuneStatsSnapshot et al unchanged.
  * web/src/api/client.ts — new getAdminSCEPProfiles helper.
  * web/src/pages/SCEPAdminPage.tsx — full rewrite as the tabbed
    surface. Reuses the existing ConfirmReloadModal and Intune
    deep-dive card components verbatim; adds ProfileSummaryCard
    (lean card for the Profiles tab) and ActivityTab. URL state
    sync via useSearchParams so deep links survive reloads + browser
    back/forward. The legacy /scep/intune route alias defaults the
    activeTab to 'intune' on mount.
  * web/src/main.tsx — new <Route path='scep' /> + preserved
    <Route path='scep/intune' /> alias. Both render SCEPAdminPage.
  * web/src/components/Layout.tsx — nav link rebranded:
    label 'SCEP Intune' → 'SCEP Admin', to '/scep/intune' → '/scep'.

Frontend tests (20 — full rebuild):

  * Admin gate (non-admin sees gated banner + zero admin API calls)
  * Profiles tab default + Intune tab tabswitch + ?tab=intune deep
    link + legacy /scep/intune alias all land on Intune
  * Profiles tab status badges (Intune + mTLS + challenge-set)
    reflect each profile's flags
  * RA cert expiry tone bands (good ≥30d / warn 7-30d / bad <7d /
    EXPIRED) verified across three fixture profiles
  * 'View Intune details →' only renders for Intune-enabled
    profiles AND switches tabs on click
  * Empty-state banner when no profiles configured
  * Intune tab counters render with the existing Phase 9 deep-dive
    shape; reload modal Open/Confirm/Cancel/Error paths all pinned
  * Recent Activity tab merges all four SCEP audit actions across
    four parallel useQuery calls; filter chips
    (all/initial/renewal/intune/static) narrow correctly
  * Error path surfaces ErrorState on the active tab

Docs:

  * docs/scep-intune.md — Operational monitoring section heading
    expanded to '(SCEP Administration → Intune Monitoring tab)'.
    Page-surface description rewritten for the tabbed shape;
    admin-endpoints list extended with the new /admin/scep/profiles
    entry.
  * docs/architecture.md — Microsoft Intune Connector trust anchor
    subsection updated to reference the Intune Monitoring tab inside
    the SCEP Administration page + lists all three admin endpoints.
  * docs/legacy-est-scep.md — forward-ref expanded with a parallel
    sentence for the per-profile observability surface (independent
    of Intune).
  * README.md — Enrollment Protocols bullet for Intune updated to
    'admin GUI SCEP Administration page at /scep' with the three
    tabs called out.

Verification:
  * gofmt clean on touched files
  * go vet ./... clean
  * staticcheck on intune+service+handler+router+cmd-server clean
  * go test -short across intune+service+handler+router+cmd-server:
    all green (existing Phase 9 tests + new Profiles tests)
  * Frontend tsc --noEmit clean
  * Vitest: 20/20 SCEPAdminPage tests + 3/3 sibling AuditPage tests
    pass
  * G-3 docs-drift CI guard reproduced locally: clean (no new env
    vars; existing CERTCTL_SCEP_ allowlist prefix covers everything)
  * M-009 hard-zero useMutation guard reproduced locally: clean
    (the existing reload mutation already used useTrackedMutation
    from the Phase 9 follow-up commit 28e277a)
  * openapi-parity test green (new GET /api/v1/admin/scep/profiles
    operation documented)
  * M-008 admin-gate scanner green (existing admin_scep_intune.go
    entry covers all three handler methods; the test scanner
    enforces the triplet by file, not by endpoint, and the new
    Profiles triplet was added to the existing test file)

Backward compat preserved:
  * /api/v1/admin/scep/intune/stats unchanged — same JSON shape,
    same error codes, same M-008 gate
  * /api/v1/admin/scep/intune/reload-trust unchanged
  * /scep/intune route still works (alias to /scep with activeTab=intune)
  * IntuneStatsSnapshot Go type unchanged
  * IntuneStats(now) accessor unchanged

Refs: cowork/scep-gui-restructure-prompt.md
      cowork/scep-rfc8894-intune-master-prompt.md::Phase 9
      Phase 11.5 (SCEP probe in scanner — opt-in) and Phase 12
      (release prep + tag) of the master bundle resume after this.

docs/architecture.md

@@ -863,12 +863,16 @@ startup via `intune.LoadTrustAnchor` (refuses to boot on empty
 bundle / parse error / past-`NotAfter` cert) and reloads atomically
 on `SIGHUP` (mirrors the server TLS-cert hot-reload pattern). A bad
 reload keeps the OLD pool in place — operators get a recoverable
-failure window rather than a service-down. The admin GUI's SCEP
-Intune Monitoring tab + admin endpoints
-(`GET /api/v1/admin/scep/intune/stats`,
-`POST /api/v1/admin/scep/intune/reload-trust`) are M-008 admin-gated;
-non-admin Bearer callers get HTTP 403 because the trust-anchor
-expiries are sensitive operational metadata.
+failure window rather than a service-down. The admin GUI's
+**Intune Monitoring** tab inside the SCEP Administration page (`/scep`)
+and the parallel admin endpoints
+(`GET /api/v1/admin/scep/profiles` for the always-present per-profile
+overview that drives the Profiles tab,
+`GET /api/v1/admin/scep/intune/stats` for the Intune deep dive,
+`POST /api/v1/admin/scep/intune/reload-trust` for the SIGHUP-equivalent)
+are all M-008 admin-gated; non-admin Bearer callers get HTTP 403
+because the trust-anchor expiries + RA cert expiries + mTLS bundle
+paths are sensitive operational metadata.
 
 See [`scep-intune.md`](scep-intune.md) for the full migration playbook
 + Microsoft support statement.

docs/legacy-est-scep.md

@@ -503,6 +503,12 @@ otherwise.
   field mapping, trust-anchor extraction recipe, troubleshooting matrix,
   operational monitoring, V3-Pro deferrals, and the Microsoft support
   statement (with Microsoft Learn URLs procurement teams ask for).
+- **For per-profile SCEP observability** (RA cert expiry countdown,
+  mTLS sibling-route status, challenge-password-set indicator, and
+  the full SCEP audit log filter), the admin GUI page lives at `/scep`
+  with three tabs: **Profiles** (default), **Intune Monitoring**,
+  **Recent Activity**. See `scep-intune.md::Operational monitoring`
+  for the Intune-specific tab inside it.
 
 ## Related docs
 

docs/scep-intune.md

@@ -245,9 +245,21 @@ common root cause and the operator action.
 | `malformed`          | Sporadic, low-volume                                              | Malformed challenge bytes — almost always a network proxy mangling the request body, or the Connector logging itself out mid-handshake. Capture a packet trace; the Connector should re-emit on the next device retry. |
 | `compliance_failed`  | V3-Pro only                                                       | The pluggable compliance check returned non-compliant. The audit-log details carries the reason string from Microsoft Graph. V2 deployments never see this counter tick.                                          |
 
-## Operational monitoring
+## Operational monitoring (SCEP Administration → Intune Monitoring tab)
 
-The Phase 9 admin GUI surface (`/scep/intune`) shows:
+The admin GUI surface for SCEP lives at `/scep` and is structured as
+three tabs: **Profiles** (default landing — every configured SCEP
+profile, lean cards with always-present fields), **Intune Monitoring**
+(the Intune-specific deep-dive described below), and **Recent Activity**
+(full SCEP audit log filter). Operators monitoring an Intune deployment
+spend most of their time on the Intune Monitoring tab, deep-linkable via
+`/scep?tab=intune` or the legacy alias `/scep/intune`. The Profiles tab
+gives the at-a-glance per-profile health (RA cert expiry, mTLS status,
+Intune enabled/disabled badge, challenge-password-set indicator) and a
+"View Intune details →" link from each Intune-enabled card that switches
+into this tab filtered to that profile.
+
+The Intune Monitoring tab shows:
 
 - **Per-profile cards** — one card per SCEP profile, with the trust
   anchor expiry countdown badge:
@@ -266,11 +278,21 @@ The Phase 9 admin GUI surface (`/scep/intune`) shows:
   Bad reloads keep the OLD pool in place; the modal stays open with
   the underlying error so the operator can correct the file and retry.
 
-Both admin endpoints (`GET /api/v1/admin/scep/intune/stats` and
-`POST /api/v1/admin/scep/intune/reload-trust`) are M-008 admin-gated.
-Non-admin Bearer callers get HTTP 403 + a clear message; the GUI
-hides the page entirely for non-admin users (UX hint; server-side
-enforcement is independent).
+Three admin endpoints back the page:
+
+- `GET /api/v1/admin/scep/profiles` — per-profile snapshot for the
+  Profiles tab; surfaces RA cert subject + NotAfter + days-to-expiry,
+  mTLS sibling-route status + bundle path, challenge-password-set flag,
+  and an optional `intune` sub-block for Intune-enabled profiles.
+- `GET /api/v1/admin/scep/intune/stats` — Intune-specific deep-dive
+  for the Intune Monitoring tab; per-status counters + trust anchor
+  pool details. Backward-compat shape preserved from Phase 9.
+- `POST /api/v1/admin/scep/intune/reload-trust` — SIGHUP-equivalent
+  trust anchor reload, body `{"path_id": "<pathID>"}`.
+
+All three are M-008 admin-gated. Non-admin Bearer callers get HTTP 403
++ a clear message; the GUI hides the page entirely for non-admin users
+(UX hint; server-side enforcement is independent).
 
 ### Recommended alert thresholds