feat: add network certificate discovery (M21) and Prometheus metrics (M22)

M21 adds server-side active TLS scanning of CIDR ranges with concurrent
probing, sentinel agent pattern for pipeline reuse, and full CRUD API for
scan targets. M22 adds Prometheus exposition format endpoint alongside
existing JSON metrics. Comprehensive documentation audit updates all docs
to reflect 91 endpoints, 19 tables, 6 scheduler loops, and 900+ tests.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/config/config.go

@@ -11,16 +11,17 @@ import (
 // Config represents the complete application configuration.
 // All configuration values are read from environment variables with CERTCTL_ prefix.
 type Config struct {
-	Server    ServerConfig
-	Database  DatabaseConfig
-	Scheduler SchedulerConfig
-	Log       LogConfig
-	Auth      AuthConfig
-	RateLimit RateLimitConfig
-	CORS      CORSConfig
-	Keygen    KeygenConfig
-	CA        CAConfig
-	Notifiers NotifierConfig
+	Server       ServerConfig
+	Database     DatabaseConfig
+	Scheduler    SchedulerConfig
+	Log          LogConfig
+	Auth         AuthConfig
+	RateLimit    RateLimitConfig
+	CORS         CORSConfig
+	Keygen       KeygenConfig
+	CA           CAConfig
+	Notifiers    NotifierConfig
+	NetworkScan  NetworkScanConfig
 }
 
 // NotifierConfig contains configuration for notification connectors.
@@ -80,6 +81,12 @@ type OpenSSLConfig struct {
 	TimeoutSeconds int
 }
 
+// NetworkScanConfig controls the server-side active TLS scanner.
+type NetworkScanConfig struct {
+	Enabled      bool          // Enable network scanning (default false)
+	ScanInterval time.Duration // How often to run network scans (default 6h)
+}
+
 // ServerConfig contains HTTP server configuration.
 type ServerConfig struct {
 	Host string
@@ -178,6 +185,10 @@ func Load() (*Config, error) {
 			OpsGenieAPIKey:      getEnv("CERTCTL_OPSGENIE_API_KEY", ""),
 			OpsGeniePriority:    getEnv("CERTCTL_OPSGENIE_PRIORITY", "P3"),
 		},
+		NetworkScan: NetworkScanConfig{
+			Enabled:      getEnvBool("CERTCTL_NETWORK_SCAN_ENABLED", false),
+			ScanInterval: getEnvDuration("CERTCTL_NETWORK_SCAN_INTERVAL", 6*time.Hour),
+		},
 	}
 
 	if err := cfg.Validate(); err != nil {