feat(celery): CA-extensible check_dcv_expiration task (RDNA-1000)

[evan-datadog]

Summary

Daily check_dcv_expiration Celery task discovers CA plugins implementing
get_dcv_expiration_data() and emits lemur.dcv.days_until_expiration.
DigiCert is the first implementation.

Metric	Type	Tags
lemur.dcv.days_until_expiration	gauge	domain, ca, validation_type, org_id

• IssuerPlugin base: optional get_dcv_expiration_data() hook (default: [])
• DigiCert plugin: first implementation via GET /v2/domain (paginated)
• Config: DIGICERT_DCV_CHECK_ENABLED (default True)

Other CAs add DCV monitoring by overriding get_dcv_expiration_data() — no
changes to the Celery task required.

Note: Celery beat schedule entry must be added to k8s-resources
chart/config/lemur.conf.py separately.

[Copilot]

Pull request overview

Adds a CA-extensible daily Celery task to report Domain Control Validation (DCV) expiration timelines via metrics, with DigiCert as the first CA plugin implementation.

Changes:

• Introduces check_dcv_expiration Celery task that queries issuer plugins for DCV expiration data and emits lemur.dcv.days_until_expiration.
• Extends IssuerPlugin with an optional get_dcv_expiration_data() hook (default []) and implements it for DigiCert using /services/v2/domain pagination.
• Adds configuration flag DIGICERT_DCV_CHECK_ENABLED and unit tests covering the new task + DigiCert implementation.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
local/src/lemur.conf.py	Documents beat schedule entry (commented) and adds DIGICERT_DCV_CHECK_ENABLED default.
lemur/common/celery.py	Adds check_dcv_expiration task emitting DCV expiration metrics and summary metrics.
lemur/plugins/bases/issuer.py	Adds optional get_dcv_expiration_data() hook to issuer plugin base.
lemur/plugins/lemur_digicert/plugin.py	Implements DigiCert DCV expiration discovery via /v2/domain pagination.
lemur/tests/test_dcv_celery.py	Adds tests for base hook behavior and Celery task metric emission/error isolation.
lemur/plugins/lemur_digicert/tests/test_digicert.py	Adds tests for DigiCert get_dcv_expiration_data() behavior and config disable flag.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[evan-datadog]

🤖 Addressed all three review items:

1. Metric prefix — already correct: emitting `dcv.days_until_expiration` (the metrics provider namespaces under `lemur.` automatically). This was fixed in an earlier commit.

2. Pagination removed — latest commit replaces the `while True` loop with a single `/v2/domain` call. No pagination params needed at our domain count.

3. `/v2/domain` API shape — parsing matches the real response shape (`domain.get("dcv_expiration")` returns a dict of `{validation_type: expiry_date}`), as confirmed in the earlier reply.

Ready for re-review, @maperu.