feat(m28+m29+m30): ACME ARI, email digest, and Helm chart

M28: ACME Renewal Information (RFC 9702) — CA-directed renewal timing
with cert ID computation, directory endpoint discovery, graceful
degradation for non-ARI CAs. 19 tests.

M29: Email notifier wiring + scheduled certificate digest — SMTP
connector bridged to service layer via NotifierAdapter, DigestService
with HTML email template, 7th scheduler loop (24h), digest preview/send
API endpoints and GUI card. 21 tests.

M30: Production-ready Helm chart — server Deployment, PostgreSQL
StatefulSet, agent DaemonSet, ConfigMaps, Secrets, Ingress, security
contexts, health probes, example values for dev/prod/ACME scenarios.

Also: OpenAPI spec updates, MCP tool additions, CI helm-lint job,
documentation updates across 5 doc files and README.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/connector/issuer/interface.go

@@ -35,6 +35,18 @@ type Connector interface {
 	// GetCACertPEM returns the PEM-encoded CA certificate chain for this issuer.
 	// Used by the EST /cacerts endpoint. Returns empty string if not available.
 	GetCACertPEM(ctx context.Context) (string, error)
+
+	// GetRenewalInfo retrieves ACME Renewal Information (ARI) per RFC 9702 for a certificate.
+	// certPEM is the PEM-encoded certificate. Returns nil, nil if the CA does not support ARI.
+	GetRenewalInfo(ctx context.Context, certPEM string) (*RenewalInfoResult, error)
+}
+
+// RenewalInfoResult holds the ACME ARI response from a CA.
+type RenewalInfoResult struct {
+	SuggestedWindowStart time.Time
+	SuggestedWindowEnd   time.Time
+	RetryAfter           time.Time
+	ExplanationURL       string
 }
 
 // IssuanceRequest contains the parameters for issuing a new certificate.