fix: Docker Compose missing migrations, network scan []int crash, demo seed data

Three bugs fixed:
- Docker Compose only mounted migration 000001; migrations 000002-000007
  (profiles, agent groups, revocation, discovery, network scans) never ran,
  breaking half the demo features. Now mounts all 7 migrations in order.
- Network Scans page crashed with pq.Array scan error because lib/pq
  doesn't support []int, only []int64. Changed Ports field accordingly.
- Dashboard pie chart displayed "RenewalInProgress" without spaces.
  Added formatStatus() helper for PascalCase → spaced display.

Also adds first-run demo experience improvements:
- 9 discovered certificates (filesystem + network scan mix)
- 3 discovery scans with recent timestamps
- 2 AwaitingApproval renewal jobs for approval workflow demo
- CERTCTL_NETWORK_SCAN_ENABLED=true in Docker Compose
- Network scan targets seeded with last_scan results
- Version badge updated to v2.0.5
- Docs updated (quickstart, advanced demo) to reference seeded data

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/service/network_scan.go

@@ -76,7 +76,7 @@ func (s *NetworkScanService) CreateTarget(ctx context.Context, target *domain.Ne
 		}
 	}
 	if len(target.Ports) == 0 {
-		target.Ports = []int{443}
+		target.Ports = []int64{443}
 	}
 	if target.ScanIntervalHours == 0 {
 		target.ScanIntervalHours = 6
@@ -276,7 +276,7 @@ func (s *NetworkScanService) scanTarget(ctx context.Context, target *domain.Netw
 }
 
 // expandEndpoints converts CIDR ranges and ports into a list of "ip:port" endpoints.
-func (s *NetworkScanService) expandEndpoints(cidrs []string, ports []int) []string {
+func (s *NetworkScanService) expandEndpoints(cidrs []string, ports []int64) []string {
 	var endpoints []string
 
 	for _, cidr := range cidrs {