feat(m28+m29+m30): ACME ARI, email digest, and Helm chart

M28: ACME Renewal Information (RFC 9702) — CA-directed renewal timing
with cert ID computation, directory endpoint discovery, graceful
degradation for non-ARI CAs. 19 tests.

M29: Email notifier wiring + scheduled certificate digest — SMTP
connector bridged to service layer via NotifierAdapter, DigestService
with HTML email template, 7th scheduler loop (24h), digest preview/send
API endpoints and GUI card. 21 tests.

M30: Production-ready Helm chart — server Deployment, PostgreSQL
StatefulSet, agent DaemonSet, ConfigMaps, Secrets, Ingress, security
contexts, health probes, example values for dev/prod/ACME scenarios.

Also: OpenAPI spec updates, MCP tool additions, CI helm-lint job,
documentation updates across 5 doc files and README.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/api/handler/digest.go

@@ -0,0 +1,76 @@
+package handler
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+)
+
+// DigestServicer defines the interface for digest operations used by the handler.
+type DigestServicer interface {
+	PreviewDigest(ctx context.Context) (string, error)
+	SendDigest(ctx context.Context) error
+}
+
+// DigestHandler provides HTTP endpoints for certificate digest operations.
+type DigestHandler struct {
+	service DigestServicer
+}
+
+// NewDigestHandler creates a new digest handler.
+func NewDigestHandler(service DigestServicer) *DigestHandler {
+	return &DigestHandler{service: service}
+}
+
+// PreviewDigest renders the digest HTML without sending it.
+// GET /api/v1/digest/preview
+func (h *DigestHandler) PreviewDigest(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+
+	if h.service == nil {
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusServiceUnavailable)
+		json.NewEncoder(w).Encode(map[string]string{"error": "digest service not configured"})
+		return
+	}
+
+	html, err := h.service.PreviewDigest(r.Context())
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+
+	w.Header().Set("Content-Type", "text/html; charset=utf-8")
+	w.WriteHeader(http.StatusOK)
+	w.Write([]byte(html))
+}
+
+// SendDigest triggers an immediate digest send.
+// POST /api/v1/digest/send
+func (h *DigestHandler) SendDigest(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+
+	if h.service == nil {
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusServiceUnavailable)
+		json.NewEncoder(w).Encode(map[string]string{"error": "digest service not configured"})
+		return
+	}
+
+	if err := h.service.SendDigest(r.Context()); err != nil {
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusInternalServerError)
+		json.NewEncoder(w).Encode(map[string]string{"error": err.Error()})
+		return
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(http.StatusOK)
+	json.NewEncoder(w).Encode(map[string]string{"status": "sent"})
+}