Fix dashboard template bugs, acme date parsing, wireguard sudoers match, and stale docs

- dashboard.html: Fix zones, leases, wg_status, cert key names, add services var
- server.py: Pass services to dashboard template via _get_service_status()
- lib/acme.py: Fix dead third date format (%Y%m%d%H%M%z) using astimezone(UTC)
- lib/wireguard.py: Add -- separator to cp command to match sudoers rule
- lib/nginx.py: Replace shallow dict.copy() with {**...} for DEFAULT_SSL
- AGENTS.md: Update test count 149 -> 154
- docs/api.md: Rename cert field expiry -> expires_at

webui/api/firewall.py

@@ -37,10 +37,7 @@ def _error(msg, code=400):
 
 
 def _ok(data=None):
-    body = {"ok": True}
-    if data is not None:
-        body["data"] = data
-    return jsonify(body)
+    return jsonify({"ok": True, "data": data})
 
 
 # ---------------------------------------------------------------------------
@@ -69,6 +66,8 @@ def list_zones():
 @bp.route("/zones/<name>", methods=["GET"])
 def zone_details(name):
     try:
+        if name not in get_available_zones():
+            return _error(f"Zone '{name}' does not exist", 404)
         info = get_zone_info(name)
         return jsonify({"ok": True, "data": info})
     except RuntimeError as exc:
@@ -86,7 +85,7 @@ def create_zone_bp():
         if zone_name in get_available_zones():
             return _error(f"Zone '{zone_name}' already exists", 400)
         create_zone(zone_name, target)
-        return _ok({"name": zone_name, "target": target})
+        return _ok(None)
     except RuntimeError as exc:
         return _error(str(exc), 500)
 
@@ -98,7 +97,7 @@ def delete_zone_bp(name):
         if name not in available:
             return _error(f"Zone '{name}' does not exist", 404)
         delete_zone(name)
-        return _ok({"name": name})
+        return _ok(None)
     except RuntimeError as exc:
         return _error(str(exc), 500)