Add certificate detail page and tests

- Add cert detail page with metadata display and download link
- Change cert issuance to return tgz with key.pem and cert.pem
- Add handleCertDetail and handleCertDownload handlers
- Extract vaultBackend interface for testability
- Add table-driven tests for cert detail handlers

Co-authored-by: Junie <junie@jetbrains.com>

internal/webserver/server.go

@@ -18,10 +18,32 @@ import (
 	webui "git.wntrmute.dev/kyle/metacrypt/web"
 )
 
+// vaultBackend is the interface used by WebServer to communicate with the vault.
+// It is satisfied by *VaultClient and can be replaced with a mock in tests.
+type vaultBackend interface {
+	Status(ctx context.Context) (string, error)
+	Init(ctx context.Context, password string) error
+	Unseal(ctx context.Context, password string) error
+	Login(ctx context.Context, username, password, totpCode string) (string, error)
+	ValidateToken(ctx context.Context, token string) (*TokenInfo, error)
+	ListMounts(ctx context.Context, token string) ([]MountInfo, error)
+	Mount(ctx context.Context, token, name, engineType string, config map[string]interface{}) error
+	GetRootCert(ctx context.Context, mount string) ([]byte, error)
+	GetIssuerCert(ctx context.Context, mount, issuer string) ([]byte, error)
+	ImportRoot(ctx context.Context, token, mount, certPEM, keyPEM string) error
+	CreateIssuer(ctx context.Context, token string, req CreateIssuerRequest) error
+	ListIssuers(ctx context.Context, token, mount string) ([]string, error)
+	IssueCert(ctx context.Context, token string, req IssueCertRequest) (*IssuedCert, error)
+	SignCSR(ctx context.Context, token string, req SignCSRRequest) (*SignedCert, error)
+	GetCert(ctx context.Context, token, mount, serial string) (*CertDetail, error)
+	ListCerts(ctx context.Context, token, mount string) ([]CertSummary, error)
+	Close() error
+}
+
 // WebServer is the standalone web UI server.
 type WebServer struct {
 	cfg      *config.Config
-	vault    *VaultClient
+	vault    vaultBackend
 	logger   *slog.Logger
 	httpSrv  *http.Server
 	staticFS fs.FS