feat: Add EnsureCentralService + improved tests

Linter-contributed improvements:
- EnsureCentralService() method: registers Central's own domain as a
  service from config, with cleanup on domain change
- Tests for EnsureCentralService: registration, idempotency, domain
  change cleanup, no-domain-is-noop
- Improved reconciliation tests with Central as a registered service
- Certbot handler cleanup

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/api/v1/handlers_certbot.go

@@ -3,8 +3,10 @@ package v1
 import (
 	"fmt"
 	"net/http"
+	"os"
 	"strings"
 
+	"github.com/wild-cloud/wild-central/internal/certbot"
 	"github.com/wild-cloud/wild-central/internal/config"
 	"github.com/wild-cloud/wild-central/internal/services"
 )
@@ -58,6 +60,37 @@ func (api *API) CertStatus(w http.ResponseWriter, r *http.Request) {
 		certs = append(certs, entry)
 	}
 
+	// Include standalone certs from disk (e.g. wildcard certs) not tied to a service.
+	certsDir := "/etc/haproxy/certs/"
+	if entries, err := os.ReadDir(certsDir); err == nil {
+		for _, e := range entries {
+			if !strings.HasSuffix(e.Name(), ".pem") {
+				continue
+			}
+			domain := strings.TrimSuffix(e.Name(), ".pem")
+			if seen[domain] {
+				continue
+			}
+			seen[domain] = true
+			status := api.certbot.GetStatus(domain)
+			if !status.Exists {
+				// PEM file exists but openssl couldn't parse it — skip
+				continue
+			}
+			// Use the certbot live directory to confirm this is a certbot-managed cert
+			source := "standalone"
+			certLive := certbot.CertPath(domain)
+			if _, err := os.Stat(certLive); err == nil {
+				source = "certbot"
+			}
+			certs = append(certs, map[string]any{
+				"domain": domain,
+				"source": source,
+				"cert":   status,
+			})
+		}
+	}
+
 	respondJSON(w, http.StatusOK, map[string]any{
 		"configured":   centralDomain != "",
 		"domain":       centralDomain,