Fix dashboard template bugs, acme date parsing, wireguard sudoers match, and stale docs

- dashboard.html: Fix zones, leases, wg_status, cert key names, add services var
- server.py: Pass services to dashboard template via _get_service_status()
- lib/acme.py: Fix dead third date format (%Y%m%d%H%M%z) using astimezone(UTC)
- lib/wireguard.py: Add -- separator to cp command to match sudoers rule
- lib/nginx.py: Replace shallow dict.copy() with {**...} for DEFAULT_SSL
- AGENTS.md: Update test count 149 -> 154
- docs/api.md: Rename cert field expiry -> expires_at

webui/api/certs.py

@@ -28,10 +28,7 @@ def _error(msg, code=400):
 
 
 def _ok(data=None):
-    body = {"ok": True}
-    if data is not None:
-        body["data"] = data
-    return jsonify(body)
+    return jsonify({"ok": True, "data": data})
 
 
 # ---------------------------------------------------------------------------
@@ -70,14 +67,11 @@ def issue_bp():
     if not domain:
         return _error("'domain' is required", 400)
     webroot = body.get("webroot")
-    standalone = body.get("standalone", False)
     try:
-        result = issue(domain, webroot=webroot, standalone=standalone)
+        result = issue(domain, webroot=webroot)
         if result.get("success"):
-            return _ok(result)
-        return jsonify(
-            {"ok": False, "error": result.get("error", "Unknown error"), "data": result}
-        ), 400
+            return _ok(None)
+        return _error(result.get("error", "Unknown error"), 500)
     except RuntimeError as exc:
         return _error(str(exc), 500)
 
@@ -92,10 +86,8 @@ def renew_bp(domain):
     try:
         result = renew(domain)
         if result.get("success"):
-            return _ok(result)
-        return jsonify(
-            {"ok": False, "error": result.get("error", "Unknown error"), "data": result}
-        ), 400
+            return _ok(None)
+        return _error(result.get("error", "Unknown error"), 500)
     except RuntimeError as exc:
         return _error(str(exc), 500)
 
@@ -107,10 +99,16 @@ def renew_bp(domain):
 
 @bp.route("/<domain>", methods=["DELETE"])
 def remove_bp(domain):
+    try:
+        get_cert_info(domain)
+    except ValueError as exc:
+        return _error(str(exc), 404)
+    except RuntimeError as exc:
+        return _error(str(exc), 500)
     try:
         remove(domain)
-        return _ok({"domain": domain})
-    except (RuntimeError, FileNotFoundError) as exc:
+        return _ok(None)
+    except RuntimeError as exc:
         return _error(str(exc), 500)