EST RFC 7030 hardening master bundle Phases 10-11: libest sidecar e2e

+ Cisco IOS quirk fixtures + ManagedCertificate.Source provenance +
EST bulk-revoke endpoint + 13 typed audit action codes.

Phase 10.1 — libest reference-client sidecar:
- deploy/test/libest/Dockerfile: multi-stage Debian-bookworm-slim
  build of Cisco's libest v3.2.0-2 from source (autoconf/automake/
  libtool + libcurl4-openssl-dev + libssl-dev). Runtime stage
  carries only estclient + bash + openssl + ca-certificates so the
  exec surface stays small + predictable.
- docker-compose.test.yml libest-client entry (profiles: [est-e2e])
  with bind mounts for /config/est (test workspace) + /config/certs
  (certctl CA bundle for TLS pinning); IP 10.30.50.9 (10.30.50.8
  was already taken by certctl-agent).
- deploy/test/est/.gitkeep keeps the bind-mount target tracked.

Phase 10.2 — 5 integration tests (//go:build integration) in
deploy/test/est_e2e_test.go:
- TestEST_LibESTClient_Enrollment_Integration (cacerts → simpleenroll
  → cert-shape assertion)
- TestEST_LibESTClient_MTLSEnrollment_Integration (mTLS sibling-route
  cert auth; skip when bootstrap cert absent)
- TestEST_LibESTClient_ServerKeygen_Integration (RFC 7030 §4.4
  multipart; skip when profile gate disabled)
- TestEST_LibESTClient_RateLimited_Integration (4th enroll trips
  per-principal cap, asserts 429-shaped error)
- TestEST_LibESTClient_ChannelBinding_Integration (libest
  --tls-exporter; skip when libest build lacks the flag).
- requireESTSidecar guard skips the suite when the operator forgot
  --profile est-e2e; helpful error message includes the exact
  command to bring the sidecar up.

Phase 10.3 — Cisco IOS quirk fixtures + 3 unit tests in
internal/api/handler/cisco_ios_quirks_test.go:
- testdata/cisco_ios_15x_pem_csr.txt: PEM body sent with
  Content-Type application/x-pem-file. Handler dispatches on
  body-prefix not Content-Type — accepts cleanly.
- testdata/cisco_ios_16x_trailing_newline_csr.txt: extra trailing
  newlines after base64 body. strings.TrimSpace tolerates.
- testdata/cisco_ios_crlf_b64_csr.txt: CRLF-wrapped base64.
  base64.StdEncoding handles CRLF + LF identically.

Phase 11.1 — ManagedCertificate.Source provenance:
- New domain.CertificateSource enum (Unspecified/EST/SCEP/API/Agent).
- Migration 000023_managed_certificates_source.up.sql adds source
  TEXT NOT NULL DEFAULT '' so existing rows scan as
  CertificateSourceUnspecified — back-compat: bulk-revoke filter
  treats empty as "any source".
- Postgres repo Insert/Update/scan paths all wire the new column.

Phase 11.2 — EST bulk-revoke endpoint:
- BulkRevocationCriteria.Source field (Source-only requests rejected
  as too broad — must accompany at least one narrower criterion).
- service.bulk_revocation.resolveCertificates post-filter by Source
  (empty=any, no SQL change so existing CertificateFilter callers
  unaffected).
- New BulkRevocationHandler.BulkRevokeEST method pins Source=EST +
  dispatches; new route POST /api/v1/est/certificates/bulk-revoke
  (M-008 admin-gated). openapi.yaml documented + parity-guard green.

Phase 11.3 — 13 typed audit action codes in
internal/service/est_audit_actions.go:
- est_simple_enroll_success / _failed
- est_simple_reenroll_success / _failed
- est_server_keygen_success / _failed
- est_auth_failed_basic / _mtls / _channel_binding
- est_rate_limited
- est_csr_policy_violation
- est_bulk_revoke
- est_trust_anchor_reloaded
- ESTService.processEnrollment + SimpleServerKeygen + ReloadTrust
  split-emit BOTH the legacy bare action codes (back-compat for the
  GUI activity-tab chip filters that match by exact string +
  existing audit-log analysers) AND the new typed _success / _failed
  variants (operator grep target + per-failure-mode counter).

Tests:
- internal/api/handler/bulk_revocation_est_test.go — 5 cases
  (admin-true happy path pins Source=EST + non-admin 403 +
  empty-criteria 400 + invalid-reason 400 + method-not-allowed).
- internal/service/est_audit_actions_test.go — 5 cases (SimpleEnroll
  legacy+typed emission / SimpleReEnroll typed / IssuerError
  typed-failed / PolicyViolation triple-emit /
  unique-string invariant).

Pre-commit verification (sandbox): gofmt clean, go vet clean
(excluding repository/postgres testcontainers limit), staticcheck
clean across api/handler/api/router/domain/service/deploy/test,
go test -short -count=1 green for every non-postgres Go package +
integration build (`go build -tags integration ./deploy/test/...`)
clean. G-3 docs-drift guard reproduced locally clean (Phases 10-11
added zero new env vars).

Spec preserved at cowork/est-rfc7030-hardening-prompt.md. Phases
12-13 (docs/est.md + WiFi/802.1X / IoT bootstrap / FreeRADIUS
recipes; release prep + tag) remain — post-2.1.0 work.

deploy/test/libest/Dockerfile

@@ -0,0 +1,78 @@
+# EST RFC 7030 hardening master bundle Phase 10.1 — libest sidecar.
+#
+# Multi-stage build of Cisco's libest reference client, used as the
+# canonical RFC 7030 client for the certctl integration test suite.
+#
+# Source: https://github.com/cisco/libest (the upstream reference
+# implementation; last tag 3.2.0-2 from 2018, but the protocol surface
+# we exercise is stable RFC 7030). We build from source rather than
+# pulling a published image because no official Cisco image exists on
+# Docker Hub + reproducible offline-friendly builds need a pinned ref.
+#
+# The builder stage compiles libest + its OpenSSL dependency; the
+# runtime stage carries only the compiled `estclient` binary +
+# `openssl` + `bash` so the integration test (which docker-execs into
+# the container) has a small, predictable surface.
+#
+# Build (from repo root):
+#   docker build -f deploy/test/libest/Dockerfile -t certctl/libest:test .
+#
+# CI uses `docker compose --profile est-e2e build libest-client` to
+# orchestrate the build alongside the rest of the test stack.
+
+ARG LIBEST_REF=v3.2.0-2
+
+FROM debian:bookworm-slim AS builder
+
+ARG LIBEST_REF
+
+# Build deps. We use the system openssl (1.1.1n in bookworm-slim) which
+# is the same major version libest 3.2.0-2 was tested against. libest
+# also wants libcurl + libsafec; we install both via apt rather than
+# building from source for reproducibility.
+RUN apt-get update && apt-get install --no-install-recommends -y \
+        autoconf \
+        automake \
+        build-essential \
+        ca-certificates \
+        git \
+        libcurl4-openssl-dev \
+        libssl-dev \
+        libtool \
+        pkg-config \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /src
+
+RUN git clone --depth 1 --branch ${LIBEST_REF} https://github.com/cisco/libest.git . \
+    && ./configure --prefix=/opt/libest --disable-shared --enable-static \
+    && make -j"$(nproc)" \
+    && make install
+
+# Runtime stage. Carries only what we need to docker-exec estclient
+# from the integration test: the compiled binary, the openssl CLI for
+# CSR generation + cert parsing, and bash for the test's exec scripts.
+FROM debian:bookworm-slim
+
+RUN apt-get update && apt-get install --no-install-recommends -y \
+        bash \
+        ca-certificates \
+        curl \
+        libcurl4 \
+        libssl3 \
+        openssl \
+    && rm -rf /var/lib/apt/lists/* \
+    && useradd --create-home --uid 1000 estuser
+
+COPY --from=builder /opt/libest/bin/estclient /usr/local/bin/estclient
+
+# /config/est is the working dir the integration test mounts; /config/certs
+# carries certctl's CA bundle (./test/certs/ca.crt) for TLS pinning.
+RUN mkdir -p /config/est /config/certs && chown -R estuser:estuser /config
+
+USER estuser
+WORKDIR /config/est
+
+# Container stays alive so the integration test can docker-exec into
+# it; matches the spec's `command: sleep infinity` directive.
+CMD ["sleep", "infinity"]