Mark CNs with no issued cert file in the TUI and CLI lists

Renewing such a CN now works (it skips the revoke), but the list gave no
hint that it was a special case until the workflow printed its warning.
Flag it at selection time instead.

_load_current_certs() sets CertInfo.has_cert_file, so every view built on
it — the TUI list, --list and --list-all — gets the flag for free. The
stat happens after the per-CN dedup, so a CN with several V-lines in
index.txt is checked once.

TUI rows render "(no cert file)" between the CN and the email, placed
before the email so a long address truncating at the right edge cannot
push the marker off screen. --list/--list-all grow a trailing CERT
column holding MISSING; the column is omitted entirely when every CN has
its .crt, since it is pure noise on a healthy PKI.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tests/test_main_screen.py

@@ -28,13 +28,15 @@ from openvpncertupdate import (
 # Helpers
 # ---------------------------------------------------------------------------
 
-def _cert(cn: str, days_left: int, email: str = "") -> CertInfo:
+def _cert(cn: str, days_left: int, email: str = "",
+          has_cert_file: bool = True) -> CertInfo:
     """Build a minimal CertInfo; expires value is a plausible UTC datetime."""
     return CertInfo(
         cn=cn,
         expires=datetime(2030, 1, 1, tzinfo=timezone.utc),
         days_left=days_left,
         email=email,
+        has_cert_file=has_cert_file,
     )
 
 
@@ -156,6 +158,31 @@ def test_cert_row_shows_email():
     assert "alice@example.com" in alice_calls[0].args[2]
 
 
+def test_cert_row_marks_missing_cert_file():
+    # index.txt lists the CN but pki/issued/<CN>.crt is gone — renewing it
+    # cannot revoke anything, so say so on the row rather than at the point
+    # of failure.
+    certs = [_cert("y.kuts", -2, email="y@example.com", has_cert_file=False)]
+    stdscr = _make_stdscr()
+    stdscr.getch.side_effect = [ord("q")]
+    with patch("openvpncertupdate.init_colors"):
+        show_main_screen(stdscr, certs)
+    calls = [c for c in stdscr.addstr.call_args_list if "y.kuts" in str(c.args[2])]
+    assert calls
+    assert "(no cert)" in calls[0].args[2]
+
+
+def test_cert_row_unmarked_when_cert_file_present():
+    certs = [_cert("alice", 10, email="alice@example.com")]
+    stdscr = _make_stdscr()
+    stdscr.getch.side_effect = [ord("q")]
+    with patch("openvpncertupdate.init_colors"):
+        show_main_screen(stdscr, certs)
+    calls = [c for c in stdscr.addstr.call_args_list if "alice" in str(c.args[2])]
+    assert calls
+    assert "(no cert)" not in calls[0].args[2]
+
+
 def test_cert_row_blank_when_no_email():
     certs = [_cert("bob", 3)]  # email defaults to ""
     stdscr = _make_stdscr()