feat: add network certificate discovery (M21) and Prometheus metrics (M22)

M21 adds server-side active TLS scanning of CIDR ranges with concurrent
probing, sentinel agent pattern for pipeline reuse, and full CRUD API for
scan targets. M22 adds Prometheus exposition format endpoint alongside
existing JSON metrics. Comprehensive documentation audit updates all docs
to reflect 91 endpoints, 19 tables, 6 scheduler loops, and 900+ tests.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docs/quickstart.md

@@ -295,8 +295,11 @@ curl -s "http://localhost:8443/api/v1/stats/expiration-timeline?days=90" | jq .
 # Job trends (last 30 days)
 curl -s "http://localhost:8443/api/v1/stats/job-trends?days=30" | jq .
 
-# System metrics
+# System metrics (JSON)
 curl -s http://localhost:8443/api/v1/metrics | jq .
+
+# System metrics (Prometheus format — for scraping by Prometheus, Grafana Agent, Datadog)
+curl -s http://localhost:8443/api/v1/metrics/prometheus
 ```
 
 ### Certificate profiles
@@ -364,6 +367,35 @@ curl -s -X POST "http://localhost:8443/api/v1/discovered-certificates/DISCOVERY_
   -d '{"managed_certificate_id": "mc-api-prod"}' | jq .
 ```
 
+### Network Certificate Discovery
+
+The server can also discover certificates by scanning TLS endpoints directly — no agent required:
+
+```bash
+# Enable network scanning (set in environment or docker-compose)
+export CERTCTL_NETWORK_SCAN_ENABLED=true
+
+# Create a scan target (e.g., scan your internal network on port 443)
+curl -s -X POST http://localhost:8443/api/v1/network-scan-targets \
+  -H "Content-Type: application/json" \
+  -d '{
+    "name": "Internal Network",
+    "cidrs": ["10.0.1.0/24"],
+    "ports": [443, 8443],
+    "enabled": true,
+    "scan_interval_hours": 6,
+    "timeout_ms": 5000
+  }' | jq .
+
+# Trigger an immediate scan
+curl -s -X POST http://localhost:8443/api/v1/network-scan-targets/nst-internal-network/scan | jq .
+
+# List scan targets with results
+curl -s http://localhost:8443/api/v1/network-scan-targets | jq .
+```
+
+Discovered network certificates appear in the same `GET /api/v1/discovered-certificates` list as filesystem-discovered certs, with `agent_id=server-scanner` and `source_format=network`.
+
 ## What's Next
 
 - **[Advanced Demo](demo-advanced.md)** — Issue a real certificate via the Local CA and watch it appear in the dashboard