feat: Enhanced cert status API + TLS certificates UI

API changes:
- /api/v1/cert/status now returns all relevant certs (central,
  wildcard, per-service) with existence status and expiry
- /api/v1/cert/provision accepts ?domain= param for per-domain
  provisioning
- Removed stale syncHAProxy references, uses reconcileNetworking

UI changes:
- Added TLS Certificates card to Cloudflare page showing cert status
  for each domain with provision/renew actions
- Updated useCert hook and cert API types for new response format

Next: extract into dedicated Certificates page.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

web/src/hooks/useCert.ts

@@ -12,7 +12,7 @@ export function useCert() {
   });
 
   const provisionMutation = useMutation({
-    mutationFn: () => certApi.provision(),
+    mutationFn: (domain?: string) => certApi.provision(domain),
     onSuccess: () => {
       queryClient.invalidateQueries({ queryKey: ['cert', 'status'] });
     },