feat: Per-service certs with opt-in wildcard provisioning

Remove automatic wildcard cert assumption. Each service gets its own
cert by default. Wildcards are user-initiated via the Certificates page.

Backend:
- HAProxy L7 frontend uses cert directory (/etc/haproxy/certs/)
  instead of single wildcard file — loads all PEMs, serves by SNI
- Cert status API shows every registered service individually with
  coveredBy field when a wildcard cert covers the domain
- Reconciliation filters L7 routes to services that have a cert
- No auto-provisioning in reconciliation (just warnings)

Frontend:
- Certificates page shows per-service cert status
- "Provision" button for individual certs
- "Add Wildcard" form for opt-in wildcard provisioning
- Fixed CloudflareComponent type errors from cert API changes

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/haproxy/config.go

@@ -205,9 +205,11 @@ frontend http_in
 
 		// L7 TLS termination backend + frontend (for HTTP routes)
 		if len(opts.HTTPRoutes) > 0 {
+			// Load all PEM files from the certs directory — HAProxy serves
+			// the right cert per-SNI. Each service gets its own <domain>.pem.
 			certPath := opts.WildcardCert
 			if certPath == "" {
-				certPath = "/etc/haproxy/certs/wildcard.pem"
+				certPath = "/etc/haproxy/certs/"
 			}
 
 			sb.WriteString("backend be_l7_termination\n")