fix: TICKET-016 document InsecureSkipVerify, TICKET-019 consistent error wrapping, TICKET-020 config struct docs

TICKET-016: Document InsecureSkipVerify rationale
- Added detailed security comments above each InsecureSkipVerify usage
- Explained that discovery/verification must see ALL certificates
- Clarified that InsecureSkipVerify is scoped to probing only
- Referenced full security audit rationale
- Updated: internal/service/network_scan.go, cmd/agent/verify.go

TICKET-019: Consistent error wrapping in services
- Wrapped raw error returns with context in DeleteTarget (network_scan.go)
- Wrapped raw error returns in ClaimDiscovered (discovery.go)
- Wrapped raw error returns in DismissDiscovered (discovery.go)
- Pattern: return fmt.Errorf("failed to <operation>: %w", err)

TICKET-020: Config struct documentation
- Added godoc comments to all config struct fields
- Documented valid values, defaults, requirements, dependencies
- Updated: NotifierConfig, KeygenConfig, CAConfig, StepCAConfig
- Updated: ACMEConfig, OpenSSLConfig, ESTConfig
- Updated: SchedulerConfig, LogConfig, AuthConfig, RateLimitConfig
- Updated: ServerConfig, DatabaseConfig, VerificationConfig, NetworkScanConfig
- All fields now have comprehensive inline documentation

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

cmd/agent/verify.go

@@ -67,7 +67,15 @@ func verifyDeployment(
 
 	dialer := &net.Dialer{Timeout: timeout}
 	conn, err := tls.DialWithDialer(dialer, "tcp", address, &tls.Config{
-		InsecureSkipVerify: true, // We accept any cert (expired, self-signed, etc.)
+		// SECURITY NOTE: InsecureSkipVerify is intentionally set to true here.
+		// Post-deployment verification must probe the live endpoint to extract and
+		// compare the served certificate fingerprint, regardless of its validity
+		// state (expired, self-signed, internal CA, etc.). This setting is scoped
+		// to verification probing only — it is NEVER used for control-plane API
+		// calls, issuer connector communication, or any operation that trusts the
+		// certificate. The verification result compares SHA-256 fingerprints only.
+		// See TICKET-016 for full security audit rationale.
+		InsecureSkipVerify: true,
 		ServerName:        targetHost, // For SNI
 	})
 	if err != nil {