feat: M25 post-deployment TLS verification + M26 Traefik/Caddy targets

M25: After deploying a certificate, the agent probes the live TLS
endpoint and compares SHA-256 fingerprints to verify the correct cert
is being served. Best-effort — failures don't block deployments.
New endpoints: POST /jobs/{id}/verify, GET /jobs/{id}/verification.
Migration 000008 adds verification columns to jobs table.

M26: Traefik target connector (file provider, auto-reload) and Caddy
target connector (dual-mode: admin API hot-reload or file-based).
Both wired into agent dispatch.

Also: restructured README to highlight supported integrations (issuers,
targets, notifiers) earlier, moved API/CLI/MCP sections lower. Updated
all docs (features, connectors, architecture, testing guide, why-certctl)
and fixed integration tests for 18-param RegisterHandlers signature.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/config/config.go

@@ -23,6 +23,7 @@ type Config struct {
 	Notifiers    NotifierConfig
 	NetworkScan  NetworkScanConfig
 	EST          ESTConfig
+	Verification VerificationConfig
 }
 
 // NotifierConfig contains configuration for notification connectors.
@@ -97,6 +98,13 @@ type NetworkScanConfig struct {
 	ScanInterval time.Duration // How often to run network scans (default 6h)
 }
 
+// VerificationConfig controls post-deployment TLS verification behavior.
+type VerificationConfig struct {
+	Enabled bool          // Enable verification (default true)
+	Timeout time.Duration // Timeout for TLS probe (default 10s)
+	Delay   time.Duration // Wait before verification after deployment (default 2s)
+}
+
 // ServerConfig contains HTTP server configuration.
 type ServerConfig struct {
 	Host string
@@ -204,6 +212,11 @@ func Load() (*Config, error) {
 			IssuerID:  getEnv("CERTCTL_EST_ISSUER_ID", "iss-local"),
 			ProfileID: getEnv("CERTCTL_EST_PROFILE_ID", ""),
 		},
+		Verification: VerificationConfig{
+			Enabled: getEnvBool("CERTCTL_VERIFY_DEPLOYMENT", true),
+			Timeout: getEnvDuration("CERTCTL_VERIFY_TIMEOUT", 10*time.Second),
+			Delay:   getEnvDuration("CERTCTL_VERIFY_DELAY", 2*time.Second),
+		},
 	}
 
 	if err := cfg.Validate(); err != nil {