feat: Add EnsureCentralService + improved tests

Linter-contributed improvements:
- EnsureCentralService() method: registers Central's own domain as a
  service from config, with cleanup on domain change
- Tests for EnsureCentralService: registration, idempotency, domain
  change cleanup, no-domain-is-noop
- Improved reconciliation tests with Central as a registered service
- Certbot handler cleanup

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/services/manager.go

@@ -3,7 +3,7 @@
 // routing, TLS certificates, and optional public exposure via DDNS.
 //
 // Each registration is keyed by its domain — one registration per domain.
-// Central's own services (its UI, VPN, firewall) come from config, not here.
+// Central registers its own UI domain here on startup (source: "central").
 package services
 
 import (