Fix dashboard template bugs, acme date parsing, wireguard sudoers match, and stale docs

- dashboard.html: Fix zones, leases, wg_status, cert key names, add services var
- server.py: Pass services to dashboard template via _get_service_status()
- lib/acme.py: Fix dead third date format (%Y%m%d%H%M%z) using astimezone(UTC)
- lib/wireguard.py: Add -- separator to cp command to match sudoers rule
- lib/nginx.py: Replace shallow dict.copy() with {**...} for DEFAULT_SSL
- AGENTS.md: Update test count 149 -> 154
- docs/api.md: Rename cert field expiry -> expires_at

system/acme-deploy.sh

@@ -0,0 +1,10 @@
+#!/bin/sh
+# acme-deploy.sh — Deploy hook for acme.sh (Vacuum Wall)
+#
+# Called by acme.sh after every successful certificate issue or renewal.
+# The nginx config reads certs directly from ~/.acme.sh/, so we only
+# need to reload nginx.  If the config is invalid (e.g. apply hasn't
+# been called yet) we exit silently — the user will reload via WebUI.
+
+sudo nginx -t 2>/dev/null && sudo nginx -s reload 2>/dev/null
+exit 0