Mark CNs with no issued cert file in the TUI and CLI lists

Renewing such a CN now works (it skips the revoke), but the list gave no
hint that it was a special case until the workflow printed its warning.
Flag it at selection time instead.

_load_current_certs() sets CertInfo.has_cert_file, so every view built on
it — the TUI list, --list and --list-all — gets the flag for free. The
stat happens after the per-CN dedup, so a CN with several V-lines in
index.txt is checked once.

TUI rows render "(no cert file)" between the CN and the email, placed
before the email so a long address truncating at the right edge cannot
push the marker off screen. --list/--list-all grow a trailing CERT
column holding MISSING; the column is omitted entirely when every CN has
its .crt, since it is pure noise on a healthy PKI.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tests/test_pki.py

@@ -22,6 +22,40 @@ def make_pki(tmp_path, now):
     return str(pki)
 
 
+# ---------------------------------------------------------------------------
+# has_cert_file — index.txt can list a CN whose pki/issued/<CN>.crt is gone
+# (index carried over from an older EasyRSA install). Those CNs cannot be
+# revoked, so the list marks them.
+# ---------------------------------------------------------------------------
+
+def test_has_cert_file_false_when_issued_dir_missing(tmp_path):
+    now = datetime.now(tz=timezone.utc)
+    pki = make_pki(tmp_path, now)
+    assert all(c.has_cert_file is False for c in load_all_certs(pki))
+
+
+def test_has_cert_file_tracks_issued_dir(tmp_path):
+    now = datetime.now(tz=timezone.utc)
+    pki = make_pki(tmp_path, now)
+    issued = tmp_path / "pki" / "issued"
+    issued.mkdir()
+    (issued / "soon.crt").write_text("-----BEGIN CERTIFICATE-----\n")
+    by_cn = {c.cn: c for c in load_all_certs(pki)}
+    assert by_cn["soon"].has_cert_file is True
+    assert by_cn["later"].has_cert_file is False
+
+
+def test_has_cert_file_set_on_expiring_view_too(tmp_path):
+    now = datetime.now(tz=timezone.utc)
+    pki = make_pki(tmp_path, now)
+    issued = tmp_path / "pki" / "issued"
+    issued.mkdir()
+    (issued / "past15.crt").write_text("-----BEGIN CERTIFICATE-----\n")
+    by_cn = {c.cn: c for c in load_expiring_certs(pki, days_past=30, days_ahead=14)}
+    assert by_cn["past15"].has_cert_file is True
+    assert by_cn["soon"].has_cert_file is False
+
+
 def test_filters_within_window(tmp_path):
     now = datetime.now(tz=timezone.utc)
     pki = make_pki(tmp_path, now)