feat: Add EnsureCentralService + improved tests

Linter-contributed improvements:
- EnsureCentralService() method: registers Central's own domain as a
  service from config, with cleanup on domain change
- Tests for EnsureCentralService: registration, idempotency, domain
  change cleanup, no-domain-is-noop
- Improved reconciliation tests with Central as a registered service
- Certbot handler cleanup

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

main.go

@@ -150,10 +150,10 @@ func main() {
 		fmt.Sscanf(v, "%d", &port)
 	}
 
-	// Tell the API what port it's running on and run initial reconciliation.
-	// Must happen AFTER port is known so Central's config-driven HAProxy
-	// route points to the correct port.
+	// Tell the API what port it's running on, register Central as a service
+	// (if a domain is configured), and reconcile all networking.
 	api.SetPort(port)
+	api.EnsureCentralService()
 	api.Reconcile()
 
 	addr := fmt.Sprintf("%s:%d", host, port)