add --list/--list-all CLI flags

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

tests/test_cli.py

@@ -292,6 +292,40 @@ def test_main_dispatches_gen_crl(monkeypatch):
     runner.regen_crl.assert_called_once_with()
 
 
+def test_main_dispatches_list(monkeypatch):
+    monkeypatch.setattr(sys, "argv", ["prog", "--list"])
+    runner = MagicMock()
+    monkeypatch.setattr("openvpncertupdate.CliRunner", lambda: runner)
+    main()
+    runner.list_certs.assert_called_once_with(show_all=False)
+
+
+def test_main_dispatches_list_all(monkeypatch):
+    monkeypatch.setattr(sys, "argv", ["prog", "--list-all"])
+    runner = MagicMock()
+    monkeypatch.setattr("openvpncertupdate.CliRunner", lambda: runner)
+    main()
+    runner.list_certs.assert_called_once_with(show_all=True)
+
+
+def test_main_list_skips_ca_passphrase_resolution(monkeypatch):
+    monkeypatch.setattr(sys, "argv", ["prog", "--list"])
+    monkeypatch.setattr("openvpncertupdate.CliRunner", lambda: MagicMock())
+    mock_resolve = MagicMock()
+    monkeypatch.setattr("openvpncertupdate.resolve_ca_passphrase", mock_resolve)
+    main()
+    mock_resolve.assert_not_called()
+
+
+def test_main_list_all_skips_ca_passphrase_resolution(monkeypatch):
+    monkeypatch.setattr(sys, "argv", ["prog", "--list-all"])
+    monkeypatch.setattr("openvpncertupdate.CliRunner", lambda: MagicMock())
+    mock_resolve = MagicMock()
+    monkeypatch.setattr("openvpncertupdate.resolve_ca_passphrase", mock_resolve)
+    main()
+    mock_resolve.assert_not_called()
+
+
 def test_main_no_args_launches_tui(monkeypatch):
     monkeypatch.setattr(sys, "argv", ["prog"])
     app = MagicMock()