feat(M34): dynamic issuer configuration with encrypted config storage

Replace static env-var-based issuer wiring with GUI-driven dynamic
configuration stored encrypted in PostgreSQL. Operators can now
configure, test, enable/disable, and manage issuers from the dashboard
without restarting the server.

Key changes:
- AES-256-GCM encryption for sensitive issuer config at rest (PBKDF2
  key derivation with 100k iterations)
- Dynamic IssuerRegistry with sync.RWMutex replacing static map
- Connector factory pattern (issuerfactory.NewFromConfig) replacing
  140 lines of static wiring in main.go
- Migration 000009: encrypted_config, last_tested_at, test_status,
  source columns on issuers table
- Env var seeding on first boot with ON CONFLICT DO NOTHING
- Registry Rebuild() for atomic map swap after CRUD operations
- Issuer type validation against domain constants on Create
- Audit trail for test connection results
- Conditional seeding for step-ca/OpenSSL (only when env vars set)
- GUI: source badge, connection test status on issuer detail page

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/service/revocation_svc.go

@@ -17,7 +17,7 @@ type RevocationSvc struct {
 	revocationRepo   repository.RevocationRepository
 	auditService     *AuditService
 	notificationSvc  *NotificationService
-	issuerRegistry   map[string]IssuerConnector
+	issuerRegistry   *IssuerRegistry
 }
 
 // NewRevocationSvc creates a new revocation service.
@@ -39,7 +39,7 @@ func (s *RevocationSvc) SetNotificationService(svc *NotificationService) {
 }
 
 // SetIssuerRegistry sets the issuer registry for issuer-level revocation.
-func (s *RevocationSvc) SetIssuerRegistry(registry map[string]IssuerConnector) {
+func (s *RevocationSvc) SetIssuerRegistry(registry *IssuerRegistry) {
 	s.issuerRegistry = registry
 }
 
@@ -110,7 +110,7 @@ func (s *RevocationSvc) RevokeCertificateWithActor(ctx context.Context, certID s
 
 	// 5. Notify the issuer connector (best-effort)
 	if s.issuerRegistry != nil {
-		if issuerConn, ok := s.issuerRegistry[cert.IssuerID]; ok {
+		if issuerConn, ok := s.issuerRegistry.Get(cert.IssuerID); ok {
 			if err := issuerConn.RevokeCertificate(ctx, version.SerialNumber, reason); err != nil {
 				slog.Error("failed to notify issuer of revocation",
 					"error", err,