fix(certs): default to active certs when no search term

EJBCA's certificate/search REST endpoint rejects an empty criteria list
("Invalid criteria value, cannot be empty"), so GET /certs with no ?search
returned a 500. Default to a STATUS=CERT_ACTIVE criterion in that case so the
list endpoint returns active certificates. Search-by-query is unchanged.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

internal/service/certificate.go

@@ -38,6 +38,15 @@ func (s *CertificateService) ListCertificates(search string, limit int) ([]types
 			Value:     search,
 			Operation: "LIKE",
 		})
+	} else {
+		// EJBCA rejects an empty criteria list ("Invalid criteria value,
+		// cannot be empty"). With no search term, default to listing active
+		// certificates so GET /certs returns a useful result instead of 500.
+		criteria = append(criteria, client.CertSearchCriterion{
+			Property:  "STATUS",
+			Value:     "CERT_ACTIVE",
+			Operation: "EQUAL",
+		})
 	}
 
 	certs, err := s.client.SearchCertificates(&client.CertSearchRequest{