fix: wire issuer registry in revocation tests, correct CRL/OCSP handler test URLs

Service tests: newRevocationTestService() was missing SetIssuerRegistry(),
causing all 8 CRL/OCSP tests to fail with "issuer registry not configured".

Handler tests: CRL tests used /api/v1/issuers/{id}/crl but handler parses
/api/v1/crl/{id}. OCSP tests used query string ?serial=X but handler
expects path param /api/v1/ocsp/{id}/{serial}. Fixed all 9 test URLs.

All issues pre-date CI on v2-dev — introduced during M15b.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/service/revocation_test.go

@@ -19,6 +19,9 @@ func newRevocationTestService() (*CertificateService, *mockCertRepo, *mockRevoca
 	policyService := NewPolicyService(policyRepo, auditService)
 	certService := NewCertificateService(certRepo, policyService, auditService)
 	certService.SetRevocationRepo(revocationRepo)
+	certService.SetIssuerRegistry(map[string]IssuerConnector{
+		"iss-local": &mockIssuerConnector{},
+	})
 
 	return certService, certRepo, revocationRepo, auditRepo
 }