Fix dashboard template bugs, acme date parsing, wireguard sudoers match, and stale docs

- dashboard.html: Fix zones, leases, wg_status, cert key names, add services var
- server.py: Pass services to dashboard template via _get_service_status()
- lib/acme.py: Fix dead third date format (%Y%m%d%H%M%z) using astimezone(UTC)
- lib/wireguard.py: Add -- separator to cp command to match sudoers rule
- lib/nginx.py: Replace shallow dict.copy() with {**...} for DEFAULT_SSL
- AGENTS.md: Update test count 149 -> 154
- docs/api.md: Rename cert field expiry -> expires_at

tests/test_firewall.py

@@ -7,14 +7,19 @@ from lib import firewall
 class TestParseForwardPorts:
     def test_single_entry(self):
         result = firewall._parse_forward_ports("port=443/proto=tcp")
-        assert result == ["port=443/proto=tcp"]
+        assert len(result) == 1
+        assert result[0]["port"] == 443
+        assert result[0]["proto"] == "tcp"
 
     def test_multiple_entries(self):
         result = firewall._parse_forward_ports(
             "port=443/proto=tcp port=80/proto=tcp/toaddr=10.0.0.1/toport=8080"
         )
         assert len(result) == 2
-        assert result[0] == "port=443/proto=tcp"
+        assert result[0]["port"] == 443
+        assert result[1]["port"] == 80
+        assert result[1]["toaddr"] == "10.0.0.1"
+        assert result[1]["toport"] == 8080
 
     def test_empty_string(self):
         assert firewall._parse_forward_ports("") == []