Certificate assessor & scanner depth (chain/revocation/CT/EC keys)

Part of #61 · Tier 6 · `scanner` `assessor` · Effort: **M**

Deepen certificate coverage. The scanner currently captures only the **leaf** cert (`scan_certifications.go` reads `PeerCertificates[0]`); the assessor only flags **RSA** weak keys.

### Scanner change
- Capture the full presented chain (`PeerCertificates[...]`), not just the leaf — intermediates needed for chain checks.

### Assessor additions (extend `assess_certificate.go`)
- Chain validation (intermediate present, ordering, trust to a known root).
- Revocation: OCSP and/or CRL check.
- CT presence: leaf carries embedded SCTs.
- **EC/Ed key strength** — currently only RSA <2048 is flagged; add EC curve / Ed25519 adequacy.
- Wildcard-cert risk surfacing.
- Intermediate-cert expiry.
- Weak signature algorithm (e.g. SHA-1).

### Cost flag
OCSP/CRL adds an outbound fetch — cache + bounded timeout; soft-fail on responder errors.

### Wiring
- [ ] scanner: store chain (extend `certificates` schema or a related table); `task sqlc`
- [ ] extend assessor + `certificate_findings` issue_types
- [ ] surfacing already exists (CERT kind) — add new issue_types to `findingTitles`
- [ ] extend `assess_certificate_test.go`

### Decisions for owner
- OCSP vs CRL vs both; hard-fail vs soft-fail on revocation-unknown.

Start with scan_certifications.go and assess_certificate.go, then review the certificates schema, certificate_findings issue_types, findingTitles, and assess_certificate_test.go. Run the existing certificate tests and inspect the sqlc workflow before deciding how chain storage and revocation behavior fit. Done means the presented chain is retained, the listed certificate risks are assessed, findings are surfaced, and tests cover the additions.

Written by the indexing model from the issue text.