feat: M15b — OCSP responder, DER CRL, short-lived exemption, revocation GUI

Backend:
- Embedded OCSP responder: GET /api/v1/ocsp/{issuer_id}/{serial} returns
  signed OCSP responses (good/revoked/unknown) using CA key
- DER-encoded X.509 CRL: GET /api/v1/crl/{issuer_id} returns proper DER CRL
  signed by issuing CA with 24h validity window
- Short-lived cert exemption: certs with profile TTL < 1 hour skip CRL/OCSP
  (expiry is sufficient revocation for ephemeral workloads)
- Extended issuer connector interface with GenerateCRL and SignOCSPResponse
- Local CA implements full CRL/OCSP signing; ACME and step-ca return
  appropriate "use native endpoint" errors
- IssuerConnectorAdapter bridges new methods between layers

Frontend:
- Revoke button on certificate detail page with RFC 5280 reason modal
- Revocation banner with reason display and timestamp
- Revocation status indicators in lifecycle section
- "Revoked" filter option in certificates list
- API client: revokeCertificate() function and Certificate type extensions

Tests: ~31 new tests across connector, service, handler, and adapter layers
Docs: milestones renumbered (M13-M14, M16-M18), M15b marked complete

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/service/issuer_adapter.go

@@ -69,3 +69,29 @@ func (a *IssuerConnectorAdapter) RevokeCertificate(ctx context.Context, serial s
 		Reason: reasonPtr,
 	})
 }
+
+// GenerateCRL delegates to the underlying connector.
+func (a *IssuerConnectorAdapter) GenerateCRL(ctx context.Context, entries []CRLEntry) ([]byte, error) {
+	// Convert service-layer CRLEntry to connector-layer RevokedCertEntry
+	connEntries := make([]issuer.RevokedCertEntry, len(entries))
+	for i, e := range entries {
+		connEntries[i] = issuer.RevokedCertEntry{
+			SerialNumber: e.SerialNumber,
+			RevokedAt:    e.RevokedAt,
+			ReasonCode:   e.ReasonCode,
+		}
+	}
+	return a.connector.GenerateCRL(ctx, connEntries)
+}
+
+// SignOCSPResponse delegates to the underlying connector.
+func (a *IssuerConnectorAdapter) SignOCSPResponse(ctx context.Context, req OCSPSignRequest) ([]byte, error) {
+	return a.connector.SignOCSPResponse(ctx, issuer.OCSPSignRequest{
+		CertSerial:       req.CertSerial,
+		CertStatus:       req.CertStatus,
+		RevokedAt:        req.RevokedAt,
+		RevocationReason: req.RevocationReason,
+		ThisUpdate:       req.ThisUpdate,
+		NextUpdate:       req.NextUpdate,
+	})
+}