feat(m28+m29+m30): ACME ARI, email digest, and Helm chart

M28: ACME Renewal Information (RFC 9702) — CA-directed renewal timing
with cert ID computation, directory endpoint discovery, graceful
degradation for non-ARI CAs. 19 tests.

M29: Email notifier wiring + scheduled certificate digest — SMTP
connector bridged to service layer via NotifierAdapter, DigestService
with HTML email template, 7th scheduler loop (24h), digest preview/send
API endpoints and GUI card. 21 tests.

M30: Production-ready Helm chart — server Deployment, PostgreSQL
StatefulSet, agent DaemonSet, ConfigMaps, Secrets, Ingress, security
contexts, health probes, example values for dev/prod/ACME scenarios.

Also: OpenAPI spec updates, MCP tool additions, CI helm-lint job,
documentation updates across 5 doc files and README.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/service/issuer_adapter.go

@@ -102,3 +102,20 @@ func (a *IssuerConnectorAdapter) SignOCSPResponse(ctx context.Context, req OCSPS
 func (a *IssuerConnectorAdapter) GetCACertPEM(ctx context.Context) (string, error) {
 	return a.connector.GetCACertPEM(ctx)
 }
+
+// GetRenewalInfo delegates to the underlying connector, translating between service-layer and connector-layer types.
+func (a *IssuerConnectorAdapter) GetRenewalInfo(ctx context.Context, certPEM string) (*RenewalInfoResult, error) {
+	result, err := a.connector.GetRenewalInfo(ctx, certPEM)
+	if err != nil {
+		return nil, err
+	}
+	if result == nil {
+		return nil, nil
+	}
+	return &RenewalInfoResult{
+		SuggestedWindowStart: result.SuggestedWindowStart,
+		SuggestedWindowEnd:   result.SuggestedWindowEnd,
+		RetryAfter:           result.RetryAfter,
+		ExplanationURL:       result.ExplanationURL,
+	}, nil
+}