Fix runtime bugs, implement service layer, and overhaul documentation

Runtime fixes:
- Fix env var mismatch (CERTCTL_DB_URL → CERTCTL_DATABASE_URL)
- Fix table name mismatches (certificates → managed_certificates, notifications → notification_events)
- Add renewal_policy_id to certificate queries
- Remove non-existent created_at from notification queries
- Add env var fallback for agent CLI flags
- Graceful degradation for missing notifiers/issuers in demo mode
- Copy web/ directory in Dockerfile for dashboard serving

Service layer:
- Implement handler-service interface pattern across all services
- Wire up certificate, agent, job, policy, team, owner, audit, notification services

Documentation:
- Add concepts.md: beginner-friendly guide to TLS, CAs, private keys
- Rewrite quickstart.md with accurate API examples matching actual handlers
- Add demo-advanced.md: interactive demo with cert issuance and automated script
- Update architecture.md with correct table names and connector interfaces
- Update connectors.md to match actual Go interface signatures
- Update demo-guide.md with cross-references to new docs

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/service/job.go

@@ -179,8 +179,8 @@ func (s *JobService) GetJobStatus(ctx context.Context, jobID string) (*domain.Jo
 	return job, nil
 }
 
-// CancelJob cancels a pending or running job.
-func (s *JobService) CancelJob(ctx context.Context, jobID string) error {
+// CancelJobWithContext cancels a pending or running job.
+func (s *JobService) CancelJobWithContext(ctx context.Context, jobID string) error {
 	job, err := s.jobRepo.Get(ctx, jobID)
 	if err != nil {
 		return fmt.Errorf("failed to fetch job: %w", err)
@@ -197,3 +197,63 @@ func (s *JobService) CancelJob(ctx context.Context, jobID string) error {
 	s.logger.Info("job cancelled", "job_id", jobID)
 	return nil
 }
+
+// CancelJob cancels a job (handler interface method).
+func (s *JobService) CancelJob(id string) error {
+	return s.CancelJobWithContext(context.Background(), id)
+}
+
+// ListJobs returns paginated jobs with optional filtering (handler interface method).
+func (s *JobService) ListJobs(status, jobType string, page, perPage int) ([]domain.Job, int64, error) {
+	if page < 1 {
+		page = 1
+	}
+	if perPage < 1 {
+		perPage = 50
+	}
+
+	allJobs, err := s.jobRepo.List(context.Background())
+	if err != nil {
+		return nil, 0, fmt.Errorf("failed to list jobs: %w", err)
+	}
+
+	// Filter jobs in memory based on status and jobType
+	var filtered []*domain.Job
+	for _, job := range allJobs {
+		if job == nil {
+			continue
+		}
+		if status != "" && string(job.Status) != status {
+			continue
+		}
+		if jobType != "" && string(job.Type) != jobType {
+			continue
+		}
+		filtered = append(filtered, job)
+	}
+
+	total := int64(len(filtered))
+	start := (page - 1) * perPage
+	if start >= int(total) {
+		return nil, total, nil
+	}
+	end := start + perPage
+	if end > int(total) {
+		end = int(total)
+	}
+
+	var result []domain.Job
+	for _, job := range filtered[start:end] {
+		if job != nil {
+			result = append(result, *job)
+		}
+	}
+
+	return result, total, nil
+}
+
+// GetJob returns a single job (handler interface method).
+func (s *JobService) GetJob(id string) (*domain.Job, error) {
+	return s.jobRepo.Get(context.Background(), id)
+}
+