feat: Add Certificates page + stop auto-provisioning certs

New dedicated Certificates page in Wild Central UI showing:
- All tracked certs (central, wildcard, per-service)
- Status (valid with days remaining, or missing)
- Per-domain Provision button
- Renew All button

Cert provisioning is now user-initiated only — reconciliation logs
warnings about missing certs but does NOT auto-provision. This
prevents unexpected wildcard cert requests on startup.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

web/src/components/AppSidebar.tsx

@@ -1,5 +1,5 @@
 import { NavLink } from 'react-router';
-import { Sun, Moon, Monitor, Shield, Lock, Network, ShieldAlert, Router, Cloud, Wifi, Server } from 'lucide-react';
+import { Sun, Moon, Monitor, Shield, ShieldCheck, Lock, Network, ShieldAlert, Router, Cloud, Wifi, Server } from 'lucide-react';
 import {
   Sidebar,
   SidebarContent,
@@ -59,6 +59,7 @@ export function AppSidebar() {
     { to: '/central/ingress', icon: Network, label: 'Ingress Proxy' },
     { to: '/central/firewall', icon: Shield, label: 'Firewall' },
     { to: '/central/vpn', icon: Lock, label: 'VPN' },
+    { to: '/central/certificates', icon: ShieldCheck, label: 'Certificates' },
     { to: '/central/crowdsec', icon: ShieldAlert, label: 'CrowdSec' },
     { to: '/central/dhcp', icon: Wifi, label: 'DHCP' },
   ];