feat(M47): add Kubernetes Secrets target + AWS ACM PCA issuer connectors

Implement both M47 connectors with full cross-layer wiring:

Kubernetes Secrets target: DNS-1123 validation, kubernetes.io/tls Secret
create-or-update, chain concatenation, serial number validation, Helm
RBAC gating. 18 tests.

AWS ACM Private CA issuer: synchronous issuance (like Vault), ARN regex
validation, RFC 5280 revocation reason mapping, CA cert retrieval,
factory + env var seeding. 23 tests.

Cross-cutting: domain types, service validation, config, factory, agent
dispatch, frontend (TargetsPage, issuerTypes), OpenAPI, seed data, Helm
chart, connectors docs, README. Testing docs (testing-guide, qa-test-guide,
qa_test.go) with Parts thematically integrated near related connectors.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

web/src/pages/TargetDetailPage.tsx

@@ -24,6 +24,7 @@ const typeLabels: Record<string, string> = {
   SSH: 'SSH',
   WinCertStore: 'Windows Cert Store',
   JavaKeystore: 'Java Keystore',
+  KubernetesSecrets: 'Kubernetes Secrets',
 };
 
 function InfoRow({ label, value }: { label: string; value: React.ReactNode }) {