chore(fmt): gofmt cleanup on files touched by audit-2026-05-11 fix bundle

Whitespace alignment drift surfaced by gofmt -l after merging 7 fix branches.
Pure formatting, no semantic change. Pre-existing master drift in
internal/auth/oidc/{domain/types.go, integration_keycloak_rotate_test.go,
test_discovery.go} left untouched — that's separate tech debt.

internal/api/handler/audit.go

@@ -284,5 +284,3 @@ func (h AuditHandler) ExportAudit(w http.ResponseWriter, r *http.Request) {
 			"actor_id", actorID, "rows", len(events), "err", err)
 	}
 }
-
-

internal/auth/protocol_endpoints.go

@@ -40,7 +40,7 @@ import "strings"
 var ProtocolEndpointPrefixes = []string{
 	"/acme",
 	"/scep",
-	"/scep-mtls",            // SCEP + mTLS sibling route (Phase 6.5)
+	"/scep-mtls", // SCEP + mTLS sibling route (Phase 6.5)
 	"/.well-known/est",
 	"/.well-known/est-mtls", // EST + mTLS sibling route (EST hardening Phase 2)
 	"/.well-known/pki/ocsp",

internal/config/config_test.go

@@ -530,7 +530,7 @@ func TestIsLoopbackAddr(t *testing.T) {
 		{"10.0.0.1", false},
 		{"192.168.1.1", false},
 		{"203.0.113.42", false},
-		{"example.com", false},          // hostname → fail closed
+		{"example.com", false}, // hostname → fail closed
 		{"my-cert-server.internal", false},
 		// Defensive: host:port form should still classify the host part.
 		{"127.0.0.1:8443", true},