Add certificate revocation, deletion, and retrieval

Admins can now revoke or delete certificate records from the cert detail
page in the web UI. Revoked certificates display a [REVOKED] badge and
show revocation metadata (time and actor). Deletion redirects to the
issuer page.

The REST API gains three new authenticated endpoints that mirror the
gRPC surface:
  GET    /v1/ca/{mount}/cert/{serial}         (auth required)
  POST   /v1/ca/{mount}/cert/{serial}/revoke  (admin only)
  DELETE /v1/ca/{mount}/cert/{serial}         (admin only)

The CA engine stores revocation state (revoked, revoked_at, revoked_by)
directly in the existing CertRecord barrier entry. The proto CertRecord
message is extended with the same three fields (field numbers 10–12).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

internal/webserver/client.go

@@ -329,6 +329,9 @@ type CertDetail struct {
 	IssuedAt   string
 	ExpiresAt  string
 	CertPEM    string
+	Revoked    bool
+	RevokedAt  string
+	RevokedBy  string
 }
 
 // GetCert retrieves a full certificate record by serial number.
@@ -349,6 +352,8 @@ func (c *VaultClient) GetCert(ctx context.Context, token, mount, serial string)
 		Profile:    rec.Profile,
 		IssuedBy:   rec.IssuedBy,
 		CertPEM:    string(rec.CertPem),
+		Revoked:    rec.Revoked,
+		RevokedBy:  rec.RevokedBy,
 	}
 	if rec.IssuedAt != nil {
 		cd.IssuedAt = rec.IssuedAt.AsTime().Format("2006-01-02T15:04:05Z")
@@ -356,9 +361,24 @@ func (c *VaultClient) GetCert(ctx context.Context, token, mount, serial string)
 	if rec.ExpiresAt != nil {
 		cd.ExpiresAt = rec.ExpiresAt.AsTime().Format("2006-01-02T15:04:05Z")
 	}
+	if rec.RevokedAt != nil {
+		cd.RevokedAt = rec.RevokedAt.AsTime().Format("2006-01-02T15:04:05Z")
+	}
 	return cd, nil
 }
 
+// RevokeCert marks a certificate as revoked.
+func (c *VaultClient) RevokeCert(ctx context.Context, token, mount, serial string) error {
+	_, err := c.ca.RevokeCert(withToken(ctx, token), &pb.RevokeCertRequest{Mount: mount, Serial: serial})
+	return err
+}
+
+// DeleteCert permanently removes a certificate record.
+func (c *VaultClient) DeleteCert(ctx context.Context, token, mount, serial string) error {
+	_, err := c.ca.DeleteCert(withToken(ctx, token), &pb.DeleteCertRequest{Mount: mount, Serial: serial})
+	return err
+}
+
 // CertSummary holds lightweight certificate metadata for list views.
 type CertSummary struct {
 	Serial     string