Fix dashboard template bugs, acme date parsing, wireguard sudoers match, and stale docs

- dashboard.html: Fix zones, leases, wg_status, cert key names, add services var
- server.py: Pass services to dashboard template via _get_service_status()
- lib/acme.py: Fix dead third date format (%Y%m%d%H%M%z) using astimezone(UTC)
- lib/wireguard.py: Add -- separator to cp command to match sudoers rule
- lib/nginx.py: Replace shallow dict.copy() with {**...} for DEFAULT_SSL
- AGENTS.md: Update test count 149 -> 154
- docs/api.md: Rename cert field expiry -> expires_at

system/nginx/server_block.conf

@@ -21,8 +21,8 @@ server {
 {% if cert.type == "acme" %}
     # Certificate managed by acme.sh
 {% if cert.email %}    # ACME contact: {{ cert.email }}
-{% endif %}    ssl_certificate     /etc/letsencrypt/live/{{ domain }}/fullchain.pem;
-    ssl_certificate_key /etc/letsencrypt/live/{{ domain }}/privkey.pem;
+{% endif %}    ssl_certificate     /home/vacuum-wall/.acme.sh/{{ domain }}/fullchain.cer;
+    ssl_certificate_key /home/vacuum-wall/.acme.sh/{{ domain }}/{{ domain }}.key;
 
 {% elif cert.type == "file" %}
     ssl_certificate     {{ cert.path }};