fix: Normalize wildcard domain paths for certbot cert storage

Certbot stores wildcard certs under the base domain (e.g.,
*.example.com → /etc/letsencrypt/live/example.com/), but the path
helpers were using the raw wildcard domain. This caused deploy hooks
to reference nonexistent paths, silently failing and leaving certs
unrenewable.

internal/certbot/manager_test.go

@@ -22,7 +22,7 @@ func TestHAProxyCertPath(t *testing.T) {
 		want   string
 	}{
 		{"example.com", "/etc/haproxy/certs/example.com.pem"},
-		{"*.example.com", "/etc/haproxy/certs/*.example.com.pem"},
+		{"*.example.com", "/etc/haproxy/certs/example.com.pem"},
 		{"sub.example.com", "/etc/haproxy/certs/sub.example.com.pem"},
 	}
 	for _, tt := range tests {
@@ -34,15 +34,31 @@ func TestHAProxyCertPath(t *testing.T) {
 }
 
 func TestCertPaths(t *testing.T) {
-	domain := "example.com"
-	certPath := CertPath(domain)
-	keyPath := KeyPath(domain)
-
-	if certPath != "/etc/letsencrypt/live/example.com/fullchain.pem" {
-		t.Errorf("CertPath = %q", certPath)
+	tests := []struct {
+		domain   string
+		wantCert string
+		wantKey  string
+	}{
+		{
+			"example.com",
+			"/etc/letsencrypt/live/example.com/fullchain.pem",
+			"/etc/letsencrypt/live/example.com/privkey.pem",
+		},
+		{
+			"*.example.com",
+			"/etc/letsencrypt/live/example.com/fullchain.pem",
+			"/etc/letsencrypt/live/example.com/privkey.pem",
+		},
 	}
-	if keyPath != "/etc/letsencrypt/live/example.com/privkey.pem" {
-		t.Errorf("KeyPath = %q", keyPath)
+	for _, tt := range tests {
+		certPath := CertPath(tt.domain)
+		keyPath := KeyPath(tt.domain)
+		if certPath != tt.wantCert {
+			t.Errorf("CertPath(%q) = %q, want %q", tt.domain, certPath, tt.wantCert)
+		}
+		if keyPath != tt.wantKey {
+			t.Errorf("KeyPath(%q) = %q, want %q", tt.domain, keyPath, tt.wantKey)
+		}
 	}
 }