chore(fmt): repo-wide gofmt -w sweep — close drift surfaced by ci-pipeline-cleanup Phase 4

Mechanical reformat. The new 'gofmt drift' CI step (added in
ci-pipeline-cleanup Phase 4, commit 0f205a8) surfaced 111 files
with accumulated gofmt drift across cmd/, internal/, and deploy/test/.

Each file's diff is gofmt-standard: whitespace adjustments, intra-
group import sorting (alphabetical by import path within blank-line-
separated groups), and struct-tag column alignment. No semantic
changes — verified via 'git diff --ignore-all-space' which shows only
the line-position deltas from import reordering.

The gate stays in place after this commit. Going forward it catches
gofmt drift at PR time.

internal/api/handler/response_test.go

@@ -346,8 +346,8 @@ func TestCursorPagedResponse_EmptyNextCursor(t *testing.T) {
 
 func TestFilterFields_SingleObject(t *testing.T) {
 	data := map[string]interface{}{
-		"id":    "cert-123",
-		"name":  "My Cert",
+		"id":     "cert-123",
+		"name":   "My Cert",
 		"expiry": "2025-01-01",
 		"status": "active",
 	}
@@ -379,8 +379,8 @@ func TestFilterFields_SingleObject(t *testing.T) {
 func TestFilterFields_EmptyFields(t *testing.T) {
 	// Empty fields list should return data unchanged
 	data := map[string]interface{}{
-		"id":    "cert-123",
-		"name":  "My Cert",
+		"id":   "cert-123",
+		"name": "My Cert",
 	}
 
 	result := filterFields(data, []string{})
@@ -398,8 +398,8 @@ func TestFilterFields_EmptyFields(t *testing.T) {
 
 func TestFilterFields_NoMatchingFields(t *testing.T) {
 	data := map[string]interface{}{
-		"id":    "cert-123",
-		"name":  "My Cert",
+		"id":   "cert-123",
+		"name": "My Cert",
 	}
 
 	result := filterFields(data, []string{"nonexistent", "also-not-there"})