Fix dashboard template bugs, acme date parsing, wireguard sudoers match, and stale docs

- dashboard.html: Fix zones, leases, wg_status, cert key names, add services var
- server.py: Pass services to dashboard template via _get_service_status()
- lib/acme.py: Fix dead third date format (%Y%m%d%H%M%z) using astimezone(UTC)
- lib/wireguard.py: Add -- separator to cp command to match sudoers rule
- lib/nginx.py: Replace shallow dict.copy() with {**...} for DEFAULT_SSL
- AGENTS.md: Update test count 149 -> 154
- docs/api.md: Rename cert field expiry -> expires_at

webui/api/wireguard.py

@@ -33,10 +33,7 @@ def _error(msg, code=400):
 
 
 def _ok(data=None):
-    body = {"ok": True}
-    if data is not None:
-        body["data"] = data
-    return jsonify(body)
+    return jsonify({"ok": True, "data": data})
 
 
 # ---------------------------------------------------------------------------
@@ -82,7 +79,7 @@ def post_config():
 def apply_bp():
     try:
         apply()
-        return _ok({"message": "WireGuard configuration applied and tunnel brought up"})
+        return _ok(None)
     except RuntimeError as exc:
         return _error(str(exc), 500)
 
@@ -91,7 +88,7 @@ def apply_bp():
 def down_bp():
     try:
         down()
-        return _ok({"message": "WireGuard tunnel brought down"})
+        return _ok(None)
     except RuntimeError as exc:
         return _error(str(exc), 500)
 
@@ -117,12 +114,8 @@ def status_bp():
 @bp.route("/initialize", methods=["POST"])
 def initialize_bp():
     try:
-        cfg = initialize()
-        safe = dict(cfg)
-        if "interface" in safe:
-            safe["interface"] = dict(safe["interface"])
-            safe["interface"].pop("private_key", None)
-        return _ok(safe)
+        initialize()
+        return _ok(None)
     except RuntimeError as exc:
         return _error(str(exc), 500)
 
@@ -208,7 +201,7 @@ def generate_client_bp():
                 "Field 'server_endpoint' is required (e.g., '203.0.113.1:51820')", 400
             )
         conf_text = generate_client_conf(name, server_endpoint, server_pubkey)
-        return _ok({"config": conf_text, "name": name})
+        return _ok({"config": conf_text})
     except (KeyError, ValueError, RuntimeError) as exc:
         code = 404 if isinstance(exc, (KeyError, ValueError)) else 500
         return _error(str(exc), code)