chore(fmt): repo-wide gofmt -w sweep — close drift surfaced by ci-pipeline-cleanup Phase 4

Mechanical reformat. The new 'gofmt drift' CI step (added in
ci-pipeline-cleanup Phase 4, commit 71b2245) surfaced 111 files
with accumulated gofmt drift across cmd/, internal/, and deploy/test/.

Each file's diff is gofmt-standard: whitespace adjustments, intra-
group import sorting (alphabetical by import path within blank-line-
separated groups), and struct-tag column alignment. No semantic
changes — verified via 'git diff --ignore-all-space' which shows only
the line-position deltas from import reordering.

The gate stays in place after this commit. Going forward it catches
gofmt drift at PR time.

internal/api/handler/bulk_partial_failure_test.go

@@ -86,10 +86,10 @@ func TestBulkRenew_PartialFailure_ReportsBoth(t *testing.T) {
 	svc := &mockBulkRenewalService{
 		BulkRenewFn: func(ctx context.Context, criteria domain.BulkRenewalCriteria, actor string) (*domain.BulkRenewalResult, error) {
 			return &domain.BulkRenewalResult{
-				TotalMatched: 3,
+				TotalMatched:  3,
 				TotalEnqueued: 2,
-				TotalSkipped: 0,
-				TotalFailed:  1,
+				TotalSkipped:  0,
+				TotalFailed:   1,
 				Errors: []domain.BulkOperationError{
 					{CertificateID: "mc-failed", Error: "renewal job enqueue failed: db timeout"},
 				},