feat: add EST server (RFC 7030) for device certificate enrollment (M23)

Implement Enrollment over Secure Transport protocol with 4 endpoints under
/.well-known/est/ — cacerts (CA chain distribution), simpleenroll (initial
enrollment), simplereenroll (certificate renewal), and csrattrs (CSR
attributes). PKCS#7 certs-only wire format with hand-rolled ASN.1, accepts
both PEM and base64-encoded DER CSRs, configurable issuer and profile
binding, full audit trail. 28 new tests (18 handler + 10 service).

Also includes:
- GetCACertPEM added to issuer connector interface (all 4 issuers updated)
- EST integration tests wired into e2e test suite (13 test cases)
- QA testing guide Part 26 (15 manual EST test cases)
- All docs updated: README, features, architecture, concepts, connectors,
  quickstart, demo-advanced (endpoint counts, MCP wording, agent IDs,
  issuer interface, resource lists, OpenSSL status)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docs/connectors.md

@@ -45,6 +45,11 @@ type Connector interface {
     // SignOCSPResponse signs an OCSP response for the given certificate serial.
     // Returns nil if the issuer does not support OCSP (e.g., ACME).
     SignOCSPResponse(ctx context.Context, req OCSPSignRequest) ([]byte, error)
+
+    // GetCACertPEM returns the PEM-encoded CA certificate chain for this issuer.
+    // Used by the EST server's /cacerts endpoint (RFC 7030).
+    // Returns error if the issuer doesn't provide a static CA chain (e.g., ACME, step-ca).
+    GetCACertPEM(ctx context.Context) (string, error)
 }
 
 type IssuanceRequest struct {
@@ -206,6 +211,17 @@ Each issuer handles revocation differently:
 - **step-ca**: Calls step-ca's `/revoke` API endpoint. Clients should check step-ca's own CRL/OCSP for authoritative status.
 - **OpenSSL/Custom CA**: Invokes the configured revoke script (`CERTCTL_OPENSSL_REVOKE_SCRIPT`) with the serial number as an argument.
 
+### EST Integration (GetCACertPEM)
+
+The `GetCACertPEM()` method returns the PEM-encoded CA certificate chain, used by the EST server's `/.well-known/est/cacerts` endpoint (RFC 7030) to distribute the CA chain to enrolling devices. Each issuer handles this differently:
+
+- **Local CA**: Returns the CA certificate PEM (self-signed or sub-CA cert). This is the primary EST issuer.
+- **ACME**: Returns error — ACME CAs provide chains per-issuance, not statically.
+- **step-ca**: Returns error — step-ca serves its own `/root` endpoint for CA distribution.
+- **OpenSSL/Custom CA**: Returns error — custom script-based CAs have no CA cert access through certctl.
+
+Note: EST (Enrollment over Secure Transport) is not a connector — it's a protocol handler (`internal/api/handler/est.go`) that delegates certificate issuance to whichever issuer connector is configured via `CERTCTL_EST_ISSUER_ID`. See the [Architecture Guide](architecture.md#est-server-rfc-7030) for details.
+
 ### Planned Issuers
 
 The following issuer connectors are planned for future milestones: