feat: M15a — certificate revocation API, CRL endpoint, and revocation notifications

Implements core revocation infrastructure: POST /api/v1/certificates/{id}/revoke
with all 8 RFC 5280 reason codes, JSON-formatted CRL at GET /api/v1/crl, webhook
and email revocation notifications, best-effort issuer notification, and immutable
revocation audit trail. Includes 48 new tests across service, handler, integration,
and domain layers (600+ total). Fixes 3 pre-existing test bugs (team_test error
matching, agent_group delete status code, team handler per_page validation).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/service/team_test.go

@@ -3,11 +3,10 @@ package service
 import (
 	"context"
 	"errors"
+	"strings"
 	"testing"
-	"time"
 
 	"github.com/shankar0123/certctl/internal/domain"
-	"github.com/shankar0123/certctl/internal/repository"
 )
 
 // mockTeamRepo is a test implementation of TeamRepository
@@ -162,8 +161,8 @@ func TestTeamService_List_RepositoryError(t *testing.T) {
 		t.Fatalf("expected error, got nil")
 	}
 
-	if !errors.Is(err, errors.New("database error")) {
-		t.Errorf("expected database error, got %v", err)
+	if !strings.Contains(err.Error(), "database error") {
+		t.Errorf("expected error containing 'database error', got %v", err)
 	}
 }
 
@@ -281,7 +280,7 @@ func TestTeamService_Create(t *testing.T) {
 		t.Errorf("expected ID to be generated, got empty")
 	}
 
-	if !team.ID[:5] == "team-" {
+	if !(team.ID[:5] == "team-") {
 		t.Logf("note: generated ID is %s", team.ID)
 	}