Complete M1, M1.1, M2: end-to-end lifecycle, agent deployment, ACME v2

- Wire issuer connector end-to-end with IssuerConnectorAdapter (dependency inversion)
- Renewal/issuance job processor: RSA key + CSR generation, Local CA signing, cert version storage
- Agent work API (GET /agents/{id}/work) and job status API (POST /agents/{id}/jobs/{job_id}/status)
- Agent-side deployment: WorkItem enrichment with target type/config, NGINX/F5/IIS connector invocation
- Full ACME v2 implementation: HTTP-01 challenge solving, account registration, order lifecycle
- Update all docs (README, architecture, connectors, demo-advanced, quickstart) for M1-M2
- Fix go vet warning in deployment.go (non-constant format string)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/service/job.go

@@ -95,22 +95,15 @@ func (s *JobService) processJob(ctx context.Context, job *domain.Job) error {
 }
 
 // processIssuanceJob handles a certificate issuance job.
-// This is a placeholder that documents the flow.
-// TODO: Implement actual issuance job processing if needed.
+// It reuses the renewal service's ProcessRenewalJob since the flow is identical:
+// generate key → create CSR → call issuer → store version → create deployment jobs.
+// The only difference is semantics (new cert vs renewed cert), not mechanics.
 func (s *JobService) processIssuanceJob(ctx context.Context, job *domain.Job) error {
 	s.logger.Debug("processing issuance job", "job_id", job.ID)
 
-	// TODO: Implement issuance job processing
-	// In production:
-	//   1. Fetch the certificate
-	//   2. Fetch the issuer
-	//   3. Generate or retrieve CSR
-	//   4. Call issuer to issue new certificate
-	//   5. Create certificate version
-	//   6. Update certificate status
-	//   7. Mark job as completed
-
-	return fmt.Errorf("issuance job processing not yet implemented")
+	// Issuance follows the same code path as renewal for the Local CA:
+	// generate server-side key + CSR → sign via issuer → store cert version → deploy
+	return s.renewalService.ProcessRenewalJob(ctx, job)
 }
 
 // processValidationJob handles a certificate validation job.