feat(directive): implement BRIDGE-WP-0004 AccessManagementDirective alignment

- ActorType enum (adm/agt/atm) replaces actor_class string; config validates
  naming convention (adm-*/agt-*/atm-*) with hard ConfigError on mismatch;
  legacy 'human'/'automation' values accepted with DeprecationWarning
- cert_command: pluggable shell string run before each SSH launch; cert written
  to state dir; -i cert appended to SSH command alongside -i key
- TTL-aware cert refresh: parses Valid-to via ssh-keygen -L; pre-emptive restart
  5 min before expiry (no backoff, no attempt increment); CERT_EXPIRING logged
- CertAcquisitionError: cert failures trigger normal backoff/retry loop
- cert_identity: Key ID parsed from cert and recorded in BRIDGE_CONNECTED event
- bridge cert-status: new CLI command; exit 1 on expired cert; --json flag
- 233 tests passing, ruff clean

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/test_models.py

@@ -69,6 +69,7 @@ class TestTunnelConfig:
 
 class TestActorInfo:
     def test_fields(self):
-        a = ActorInfo(name="operator.bernd", actor_class="human", description="Bernd")
-        assert a.name == "operator.bernd"
-        assert a.actor_class == "human"
+        from bridge.models import ActorType
+        a = ActorInfo(name="adm-bernd", actor_type=ActorType.ADM, description="Bernd")
+        assert a.name == "adm-bernd"
+        assert a.actor_type == ActorType.ADM