feat: Add Certificates page + stop auto-provisioning certs

New dedicated Certificates page in Wild Central UI showing:
- All tracked certs (central, wildcard, per-service)
- Status (valid with days remaining, or missing)
- Per-domain Provision button
- Renew All button

Cert provisioning is now user-initiated only — reconciliation logs
warnings about missing certs but does NOT auto-provision. This
prevents unexpected wildcard cert requests on startup.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

web/src/router/routes.tsx

@@ -10,6 +10,7 @@ import { DnsPage } from './pages/DnsPage';
 import { CrowdSecPage } from './pages/CrowdSecPage';
 import { VpnPage } from './pages/VpnPage';
 import { CloudflarePage } from './pages/CloudflarePage';
+import { CertificatesPage } from './pages/CertificatesPage';
 import { DdnsPage } from './pages/DdnsPage';
 import { LanDnsPage } from './pages/LanDnsPage';
 
@@ -32,6 +33,7 @@ export const routes: RouteObject[] = [
       { path: 'ddns', element: <DdnsPage /> },
       { path: 'lan-dns', element: <LanDnsPage /> },
       { path: 'vpn', element: <VpnPage /> },
+      { path: 'certificates', element: <CertificatesPage /> },
     ],
   },
   {