Mark CNs with no issued cert file in the TUI and CLI lists

Renewing such a CN now works (it skips the revoke), but the list gave no
hint that it was a special case until the workflow printed its warning.
Flag it at selection time instead.

_load_current_certs() sets CertInfo.has_cert_file, so every view built on
it — the TUI list, --list and --list-all — gets the flag for free. The
stat happens after the per-CN dedup, so a CN with several V-lines in
index.txt is checked once.

TUI rows render "(no cert file)" between the CN and the email, placed
before the email so a long address truncating at the right edge cannot
push the marker off screen. --list/--list-all grow a trailing CERT
column holding MISSING; the column is omitted entirely when every CN has
its .crt, since it is pure noise on a healthy PKI.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tests/test_cli.py

@@ -308,6 +308,47 @@ def test_format_cert_table_columns_are_aligned(monkeypatch):
         assert line.index("(none)") == email_col
 
 
+def test_format_cert_table_has_no_cert_column_when_all_files_present(monkeypatch):
+    # The extra column is noise when nothing is missing, so it only appears
+    # when it has something to say.
+    import openvpncertupdate
+    certs = [openvpncertupdate.CertInfo(cn="alice", expires=None, days_left=24)]
+    monkeypatch.setattr("openvpncertupdate.get_email", MagicMock(return_value=""))
+    table = openvpncertupdate._format_cert_table(certs)
+    assert "CERT" not in table
+    assert "MISSING" not in table
+
+
+def test_format_cert_table_marks_missing_cert_file(monkeypatch):
+    import openvpncertupdate
+    certs = [
+        openvpncertupdate.CertInfo(cn="alice", expires=None, days_left=24),
+        openvpncertupdate.CertInfo(cn="y.kuts", expires=None, days_left=-2,
+                                   has_cert_file=False),
+    ]
+    monkeypatch.setattr("openvpncertupdate.get_email", MagicMock(return_value=""))
+    table = openvpncertupdate._format_cert_table(certs)
+    lines = table.splitlines()
+    assert lines[0].split() == ["CN", "EXPIRES", "EMAIL", "CERT"]
+    alice = next(l for l in lines if l.startswith("alice"))
+    kuts  = next(l for l in lines if l.startswith("y.kuts"))
+    assert "MISSING" in kuts
+    assert "MISSING" not in alice
+
+
+def test_format_cert_table_stays_aligned_with_cert_column(monkeypatch):
+    import openvpncertupdate
+    certs = [
+        openvpncertupdate.CertInfo(cn="a", expires=None, days_left=24),
+        openvpncertupdate.CertInfo(cn="a-much-longer", expires=None, days_left=5,
+                                   has_cert_file=False),
+    ]
+    monkeypatch.setattr("openvpncertupdate.get_email", MagicMock(return_value=""))
+    lines = openvpncertupdate._format_cert_table(certs).splitlines()
+    cert_col = lines[0].index("CERT")
+    assert lines[2].index("MISSING") == cert_col
+
+
 # ---------------------------------------------------------------------------
 # CliRunner.list_certs
 # ---------------------------------------------------------------------------