feat: M15b — OCSP responder, DER CRL, short-lived exemption, revocation GUI

Backend:
- Embedded OCSP responder: GET /api/v1/ocsp/{issuer_id}/{serial} returns
  signed OCSP responses (good/revoked/unknown) using CA key
- DER-encoded X.509 CRL: GET /api/v1/crl/{issuer_id} returns proper DER CRL
  signed by issuing CA with 24h validity window
- Short-lived cert exemption: certs with profile TTL < 1 hour skip CRL/OCSP
  (expiry is sufficient revocation for ephemeral workloads)
- Extended issuer connector interface with GenerateCRL and SignOCSPResponse
- Local CA implements full CRL/OCSP signing; ACME and step-ca return
  appropriate "use native endpoint" errors
- IssuerConnectorAdapter bridges new methods between layers

Frontend:
- Revoke button on certificate detail page with RFC 5280 reason modal
- Revocation banner with reason display and timestamp
- Revocation status indicators in lifecycle section
- "Revoked" filter option in certificates list
- API client: revokeCertificate() function and Certificate type extensions

Tests: ~31 new tests across connector, service, handler, and adapter layers
Docs: milestones renumbered (M13-M14, M16-M18), M15b marked complete

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/api/handler/certificates.go

@@ -23,6 +23,8 @@ type CertificateService interface {
 	TriggerDeployment(certID string, targetID string) error
 	RevokeCertificate(certID string, reason string) error
 	GetRevokedCertificates() ([]*domain.CertificateRevocation, error)
+	GenerateDERCRL(issuerID string) ([]byte, error)
+	GetOCSPResponse(issuerID string, serialHex string) ([]byte, error)
 }
 
 // CertificateHandler handles HTTP requests for certificate operations.
@@ -444,3 +446,78 @@ func (h CertificateHandler) GetCRL(w http.ResponseWriter, r *http.Request) {
 		"generated_at": time.Now().UTC().Format("2006-01-02T15:04:05Z"),
 	})
 }
+
+// GetDERCRL returns a DER-encoded X.509 CRL signed by the specified issuer.
+// GET /api/v1/crl/{issuer_id}
+func (h CertificateHandler) GetDERCRL(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		Error(w, http.StatusMethodNotAllowed, "Method not allowed")
+		return
+	}
+
+	issuerID := strings.TrimPrefix(r.URL.Path, "/api/v1/crl/")
+	if issuerID == "" {
+		Error(w, http.StatusBadRequest, "Issuer ID is required")
+		return
+	}
+
+	derBytes, err := h.svc.GenerateDERCRL(issuerID)
+	if err != nil {
+		errMsg := err.Error()
+		if strings.Contains(errMsg, "issuer not found") {
+			Error(w, http.StatusNotFound, errMsg)
+			return
+		}
+		if strings.Contains(errMsg, "do not support") || strings.Contains(errMsg, "does not support") {
+			Error(w, http.StatusNotImplemented, errMsg)
+			return
+		}
+		Error(w, http.StatusInternalServerError, "Failed to generate CRL")
+		return
+	}
+
+	w.Header().Set("Content-Type", "application/pkix-crl")
+	w.Header().Set("Cache-Control", "public, max-age=3600")
+	w.WriteHeader(http.StatusOK)
+	w.Write(derBytes)
+}
+
+// HandleOCSP processes OCSP requests.
+// GET /api/v1/ocsp/{issuer_id}/{serial_hex}
+// For simplicity, use GET with path params instead of binary POST.
+func (h CertificateHandler) HandleOCSP(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		Error(w, http.StatusMethodNotAllowed, "Method not allowed")
+		return
+	}
+
+	// Extract issuer_id and serial from path: /api/v1/ocsp/{issuer_id}/{serial_hex}
+	path := strings.TrimPrefix(r.URL.Path, "/api/v1/ocsp/")
+	parts := strings.SplitN(path, "/", 2)
+	if len(parts) < 2 || parts[0] == "" || parts[1] == "" {
+		Error(w, http.StatusBadRequest, "Issuer ID and serial number are required")
+		return
+	}
+	issuerID := parts[0]
+	serialHex := parts[1]
+
+	derBytes, err := h.svc.GetOCSPResponse(issuerID, serialHex)
+	if err != nil {
+		errMsg := err.Error()
+		if strings.Contains(errMsg, "issuer not found") {
+			Error(w, http.StatusNotFound, errMsg)
+			return
+		}
+		if strings.Contains(errMsg, "do not support") || strings.Contains(errMsg, "does not support") {
+			Error(w, http.StatusNotImplemented, errMsg)
+			return
+		}
+		Error(w, http.StatusInternalServerError, "Failed to generate OCSP response")
+		return
+	}
+
+	w.Header().Set("Content-Type", "application/ocsp-response")
+	w.Header().Set("Cache-Control", "max-age=3600")
+	w.WriteHeader(http.StatusOK)
+	w.Write(derBytes)
+}