Fix dashboard template bugs, acme date parsing, wireguard sudoers match, and stale docs

- dashboard.html: Fix zones, leases, wg_status, cert key names, add services var
- server.py: Pass services to dashboard template via _get_service_status()
- lib/acme.py: Fix dead third date format (%Y%m%d%H%M%z) using astimezone(UTC)
- lib/wireguard.py: Add -- separator to cp command to match sudoers rule
- lib/nginx.py: Replace shallow dict.copy() with {**...} for DEFAULT_SSL
- AGENTS.md: Update test count 149 -> 154
- docs/api.md: Rename cert field expiry -> expires_at

system/systemd/vacuum-wall.service

@@ -22,11 +22,16 @@ ProtectHome=read-only
 ReadWritePaths=/home/wall/vacuum-wall/data /tmp
 PrivateTmp=yes
 ProtectKernelTunables=yes
+ProtectKernelModules=yes
 ProtectControlGroups=yes
+ProtectHostname=yes
 RestrictSUIDSGID=yes
 MemoryDenyWriteExecute=yes
 RestrictRealtime=yes
+RestrictNamespaces=yes
 LockPersonality=yes
+SystemCallFilter=@system-service
+PrivateDevices=yes
 
 # Network - only loopback (nginx proxies to us)
 IPAddressDeny=all