feat: M25 post-deployment TLS verification + M26 Traefik/Caddy targets

M25: After deploying a certificate, the agent probes the live TLS
endpoint and compares SHA-256 fingerprints to verify the correct cert
is being served. Best-effort — failures don't block deployments.
New endpoints: POST /jobs/{id}/verify, GET /jobs/{id}/verification.
Migration 000008 adds verification columns to jobs table.

M26: Traefik target connector (file provider, auto-reload) and Caddy
target connector (dual-mode: admin API hot-reload or file-based).
Both wired into agent dispatch.

Also: restructured README to highlight supported integrations (issuers,
targets, notifiers) earlier, moved API/CLI/MCP sections lower. Updated
all docs (features, connectors, architecture, testing guide, why-certctl)
and fixed integration tests for 18-param RegisterHandlers signature.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

migrations/000008_verification.down.sql

@@ -0,0 +1,10 @@
+-- Drop verification-related columns from jobs table
+ALTER TABLE jobs
+DROP COLUMN IF EXISTS verification_status,
+DROP COLUMN IF EXISTS verified_at,
+DROP COLUMN IF EXISTS verification_fingerprint,
+DROP COLUMN IF EXISTS verification_error;
+
+-- Drop verification indexes
+DROP INDEX IF EXISTS idx_jobs_verification_status;
+DROP INDEX IF EXISTS idx_jobs_verified_at;

migrations/000008_verification.up.sql

@@ -0,0 +1,12 @@
+-- Add verification fields to jobs table for post-deployment TLS verification
+ALTER TABLE jobs
+ADD COLUMN IF NOT EXISTS verification_status TEXT DEFAULT 'pending',
+ADD COLUMN IF NOT EXISTS verified_at TIMESTAMPTZ,
+ADD COLUMN IF NOT EXISTS verification_fingerprint TEXT,
+ADD COLUMN IF NOT EXISTS verification_error TEXT;
+
+-- Index on verification_status for queries filtering by status
+CREATE INDEX IF NOT EXISTS idx_jobs_verification_status ON jobs(verification_status);
+
+-- Index on verified_at for temporal queries
+CREATE INDEX IF NOT EXISTS idx_jobs_verified_at ON jobs(verified_at);