Fix dashboard template bugs, acme date parsing, wireguard sudoers match, and stale docs

- dashboard.html: Fix zones, leases, wg_status, cert key names, add services var
- server.py: Pass services to dashboard template via _get_service_status()
- lib/acme.py: Fix dead third date format (%Y%m%d%H%M%z) using astimezone(UTC)
- lib/wireguard.py: Add -- separator to cp command to match sudoers rule
- lib/nginx.py: Replace shallow dict.copy() with {**...} for DEFAULT_SSL
- AGENTS.md: Update test count 149 -> 154
- docs/api.md: Rename cert field expiry -> expires_at

AGENTS.md

@@ -73,7 +73,7 @@ Adding a new privileged command requires a sudoers entry **and** the `lib/` code
 ```bash
 .venv/bin/ruff check lib/ webui/ tests/   # lint
 .venv/bin/ruff format lib/ webui/ tests/   # format
-.venv/bin/python -m pytest tests/ -v       # test (149 tests)
+.venv/bin/python -m pytest tests/ -v       # test (154 tests)
 ```
 
 Install dev tooling with `pip install -e ".[dev]"`.