Harden compliance portal auth and TLS

Align console references and OAuth branding with the
compliance-page model, and fix certificate cache eviction,
portal OAuth handlers, and magic-link edge cases left after
the trust-center rename.

Signed-off-by: Bryan Frimin <bryan@probo.com>

pkg/certmanager/renew_worker.go

@@ -97,6 +97,12 @@ func (h *renewHandler) Process(ctx context.Context, certificate coredata.Certifi
 		func(ctx context.Context, tx pg.Tx) error {
 			fullCertificate := &coredata.Certificate{}
 			if err := fullCertificate.LoadByIDForUpdateSkipLocked(ctx, tx, coredata.NewNoScope(), certificate.ID); err != nil {
+				// Another provision/renewal cycle may already hold the row
+				// (SKIP LOCKED) or the certificate may have been deleted.
+				if errors.Is(err, coredata.ErrResourceNotFound) {
+					return nil
+				}
+
 				return fmt.Errorf("cannot load certificate for renewal: %w", err)
 			}