Fix cert auto-provisioning to check wildcard coverage before provisioning

The auto-provisioner was checking for individual cert files (e.g.,
git.civilsociety.dev.pem) without checking if a wildcard cert already
covers the domain (*.civilsociety.dev.pem). This caused redundant
individual certs to be provisioned for domains already covered by
a wildcard.

Now uses hasCertForDomain() which checks both individual AND wildcard
cert coverage before deciding a cert is missing.

internal/reconcile/reconciler.go

@@ -431,19 +431,21 @@ func (r *Reconciler) ensureTLSCerts(globalCfg *config.State, doms []domains.Doma
 		gatewayDomain = parts[1]
 	}
 
-	// Collect unique missing certs (wildcard or individual)
+	// Collect unique missing certs. Use hasCertForDomain which checks
+	// both individual certs AND wildcard coverage (e.g., *.civilsociety.dev
+	// covers git.civilsociety.dev — no individual cert needed).
 	missing := map[string]bool{}
 	for _, dom := range doms {
 		if dom.TLS != domains.TLSTerminate || dom.DomainName == "" {
 			continue
 		}
-		if gatewayDomain != "" && strings.HasSuffix(dom.DomainName, "."+gatewayDomain) {
-			if _, err := os.Stat(certbot.HAProxyCertPath(gatewayDomain)); err != nil {
-				missing["*."+gatewayDomain] = true
-			}
+		if hasCertForDomain(dom.DomainName) {
 			continue
 		}
-		if _, err := os.Stat(certbot.HAProxyCertPath(dom.DomainName)); err != nil {
+		// Determine what cert to provision: wildcard for gateway subdomains, individual otherwise
+		if gatewayDomain != "" && strings.HasSuffix(dom.DomainName, "."+gatewayDomain) {
+			missing["*."+gatewayDomain] = true
+		} else {
 			missing[dom.DomainName] = true
 		}
 	}