fix: staticcheck S1016 struct conversion + Helm with/else-if parse error

- Use type conversion DigestStatusCount(c) instead of struct literal
- Replace with...else-if (invalid in Go templates) with if...else-if chain
- Add *.bak and cmd/agent/*.key/*.pem to .gitignore

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.gitignore

@@ -43,6 +43,11 @@ vendor/
 tmp/
 temp/
 *.log
+*.bak
+
+# Private keys (agent-generated, never commit)
+cmd/agent/*.key
+cmd/agent/*.pem
 
 # Database
 *.db

deploy/helm/certctl/templates/server-deployment.yaml

@@ -181,16 +181,16 @@ spec:
         {{- if .Values.server.volumes }}
         {{- toYaml .Values.server.volumes | nindent 8 }}
         {{- end }}
-      {{- with .Values.nodeAffinity }}
+      {{- if .Values.nodeAffinity }}
       affinity:
         nodeAffinity:
-          {{- toYaml . | nindent 10 }}
+          {{- toYaml .Values.nodeAffinity | nindent 10 }}
       {{- else if .Values.podAntiAffinity }}
       affinity:
         podAntiAffinity:
-          {{- toYaml . | nindent 10 }}
+          {{- toYaml .Values.podAntiAffinity | nindent 10 }}
       {{- else if .Values.podAffinity }}
       affinity:
         podAffinity:
-          {{- toYaml . | nindent 10 }}
+          {{- toYaml .Values.podAffinity | nindent 10 }}
       {{- end }}

internal/service/digest.go

@@ -122,10 +122,7 @@ func (s *DigestService) GenerateDigest(ctx context.Context) (*DigestData, error)
 		s.logger.Warn("failed to get status counts for digest", "error", err)
 	} else if counts, ok := statusRaw.([]CertificateStatusCount); ok {
 		for _, c := range counts {
-			digest.StatusCounts = append(digest.StatusCounts, DigestStatusCount{
-				Status: c.Status,
-				Count:  c.Count,
-			})
+			digest.StatusCounts = append(digest.StatusCounts, DigestStatusCount(c))
 		}
 	}