feat: M17 OpenSSL/Custom CA issuer connector + M16b CLI tool with bulk import

M17: Script-based issuer connector delegating sign/revoke/CRL to user-provided
scripts. Compatible with any CA tooling (OpenSSL, cfssl, custom PKI). Configurable
timeout, environment variable passthrough. 14 tests including timeout enforcement.

M16b: certctl-cli wraps all 76 REST API endpoints for terminal workflows. Supports
certs/agents/jobs list/get/renew/revoke/cancel, bulk PEM import with progress
reporting, server health status, table and JSON output formats. Zero external
dependencies (stdlib only). 14 tests with mock HTTP server.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/config/config.go

@@ -72,6 +72,14 @@ type ACMEConfig struct {
 	DNSCleanUpScript string
 }
 
+// OpenSSLConfig contains OpenSSL/Custom CA issuer connector configuration.
+type OpenSSLConfig struct {
+	SignScript     string
+	RevokeScript   string
+	CRLScript      string
+	TimeoutSeconds int
+}
+
 // ServerConfig contains HTTP server configuration.
 type ServerConfig struct {
 	Host string