feat: add network certificate discovery (M21) and Prometheus metrics (M22)

M21 adds server-side active TLS scanning of CIDR ranges with concurrent
probing, sentinel agent pattern for pipeline reuse, and full CRUD API for
scan targets. M22 adds Prometheus exposition format endpoint alongside
existing JSON metrics. Comprehensive documentation audit updates all docs
to reflect 91 endpoints, 19 tables, 6 scheduler loops, and 900+ tests.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/integration/lifecycle_test.go

@@ -80,6 +80,7 @@ func TestCertificateLifecycle(t *testing.T) {
 	metricsHandler := handler.NewMetricsHandler(&mockStatsService{}, time.Now())
 	healthHandler := handler.NewHealthHandler("none")
 	discoveryHandler := handler.NewDiscoveryHandler(&mockDiscoveryService{})
+	networkScanHandler := handler.NewNetworkScanHandler(&mockNetworkScanService{})
 
 	// Create router and register handlers
 	r := router.New()
@@ -100,6 +101,7 @@ func TestCertificateLifecycle(t *testing.T) {
 		metricsHandler,
 		healthHandler,
 		discoveryHandler,
+		networkScanHandler,
 	)
 
 	// Create test server
@@ -1174,3 +1176,30 @@ func (m *mockDiscoveryService) GetScan(ctx context.Context, id string) (*domain.
 func (m *mockDiscoveryService) GetDiscoverySummary(ctx context.Context) (map[string]int, error) {
 	return map[string]int{}, nil
 }
+
+// mockNetworkScanService implements handler.NetworkScanService for integration tests.
+type mockNetworkScanService struct{}
+
+func (m *mockNetworkScanService) ListTargets(ctx context.Context) ([]*domain.NetworkScanTarget, error) {
+	return nil, nil
+}
+
+func (m *mockNetworkScanService) GetTarget(ctx context.Context, id string) (*domain.NetworkScanTarget, error) {
+	return nil, fmt.Errorf("not found")
+}
+
+func (m *mockNetworkScanService) CreateTarget(ctx context.Context, target *domain.NetworkScanTarget) (*domain.NetworkScanTarget, error) {
+	return target, nil
+}
+
+func (m *mockNetworkScanService) UpdateTarget(ctx context.Context, id string, target *domain.NetworkScanTarget) (*domain.NetworkScanTarget, error) {
+	return target, nil
+}
+
+func (m *mockNetworkScanService) DeleteTarget(ctx context.Context, id string) error {
+	return nil
+}
+
+func (m *mockNetworkScanService) TriggerScan(ctx context.Context, targetID string) (*domain.DiscoveryScan, error) {
+	return nil, nil
+}

internal/integration/negative_test.go

@@ -73,6 +73,7 @@ func setupTestServer(t *testing.T) (*httptest.Server, *mockCertificateRepository
 	metricsHandler := handler.NewMetricsHandler(&mockStatsService{}, time.Now())
 	healthHandler := handler.NewHealthHandler("none")
 	discoveryHandler := handler.NewDiscoveryHandler(&mockDiscoveryService{})
+	networkScanHandler := handler.NewNetworkScanHandler(&mockNetworkScanService{})
 
 	r := router.New()
 	r.RegisterHandlers(
@@ -92,6 +93,7 @@ func setupTestServer(t *testing.T) (*httptest.Server, *mockCertificateRepository
 		metricsHandler,
 		healthHandler,
 		discoveryHandler,
+		networkScanHandler,
 	)
 
 	server := httptest.NewServer(r)
@@ -796,3 +798,5 @@ func TestRevocationEndpoints(t *testing.T) {
 		}
 	})
 }
+
+// mockNetworkScanService is defined in lifecycle_test.go (same package)