Auto-provision TLS certificates during reconciliation

Replace the passive "log warning about missing certs" approach with active
auto-provisioning:

- When Cloudflare token and operator email are configured, automatically
  provision missing certs via certbot DNS-01 during reconciliation
- When credentials aren't available, log actionable guidance (no longer
  references a non-existent "Certificates page")
- Track TLS health in reconciler Health struct (ok/degraded with missing
  cert list)
- Broadcast tls:recovered SSE event when all certs become available
- Add CertManager interface and GetCloudflareToken callback to reconciler

The convergence loop (5 min) continuously retries failed provisions,
so transient DNS-01 failures self-heal on the next tick.

internal/api/v1/handlers.go

@@ -102,6 +102,8 @@ func NewAPI(dataDir, version string, allowedOrigins []string) (*API, error) {
 		SSE:                    sseManager,
 		StatePath:              filepath.Join(dataDir, "state.yaml"),
 		GenerateAutheliaConfig: api.generateAutheliaConfig,
+		Certs:                  api.certbot,
+		GetCloudflareToken:     api.getCloudflareToken,
 	}
 
 	// Wire up domain registration reconciliation: when domains change,