Fix dashboard template bugs, acme date parsing, wireguard sudoers match, and stale docs

- dashboard.html: Fix zones, leases, wg_status, cert key names, add services var
- server.py: Pass services to dashboard template via _get_service_status()
- lib/acme.py: Fix dead third date format (%Y%m%d%H%M%z) using astimezone(UTC)
- lib/wireguard.py: Add -- separator to cp command to match sudoers rule
- lib/nginx.py: Replace shallow dict.copy() with {**...} for DEFAULT_SSL
- AGENTS.md: Update test count 149 -> 154
- docs/api.md: Rename cert field expiry -> expires_at

lib/wireguard.py

@@ -147,7 +147,7 @@ def apply() -> None:
     with open(local_tmp, "w") as f:
         f.write(conf_text)
     os.chmod(local_tmp, 0o600)
-    _run(["cp", str(local_tmp), WG_CONF_PATH])
+    _run(["cp", "--", str(local_tmp), WG_CONF_PATH])
     _run(["chown", "root:root", WG_CONF_PATH], check=False)
     local_tmp.unlink(missing_ok=True)