Adds

• http/api/pushcert.go - Added NewRetrievePushCertHandler: takes a ?topic= query param, calls store.RetrievePushCert, parses the leaf cert, and returns the same PushCertResponseJson shape (topic + not_after).
• http/api/v1.go - Replaced the single NewStorePushCertHandler registration with a method-dispatch wrapper on the same path: GET → retrieve, PUT → store, anything else → 405.

Updated:

• docs/openapi.yaml - Added a get: operation under /v1/pushcert with a required topic query parameter and the same PushCertResponse schema.
• docs/operations-guide.md - Split the "Push Cert" section into "Uploading (PUT)" and "Retrieving (GET)" subsections with a curl example for the new get.