Replace the passive "log warning about missing certs" approach with active
auto-provisioning:
- When Cloudflare token and operator email are configured, automatically
provision missing certs via certbot DNS-01 during reconciliation
- When credentials aren't available, log actionable guidance (no longer
references a non-existent "Certificates page")
- Track TLS health in reconciler Health struct (ok/degraded with missing
cert list)
- Broadcast tls:recovered SSE event when all certs become available
- Add CertManager interface and GetCloudflareToken callback to reconciler
The convergence loop (5 min) continuously retries failed provisions,
so transient DNS-01 failures self-heal on the next tick.
Paul Payne
a85bfbfe9e