Fix dashboard template bugs, acme date parsing, wireguard sudoers match, and stale docs

- dashboard.html: Fix zones, leases, wg_status, cert key names, add services var
- server.py: Pass services to dashboard template via _get_service_status()
- lib/acme.py: Fix dead third date format (%Y%m%d%H%M%z) using astimezone(UTC)
- lib/wireguard.py: Add -- separator to cp command to match sudoers rule
- lib/nginx.py: Replace shallow dict.copy() with {**...} for DEFAULT_SSL
- AGENTS.md: Update test count 149 -> 154
- docs/api.md: Rename cert field expiry -> expires_at

webui/server.py

@@ -123,6 +123,20 @@ def _safely(fn, default=None):
         return default
 
 
+def _get_service_status(dnsmasq_info, wg_info):
+    """Build a service status dict for the dashboard template."""
+    services = {}
+    if dnsmasq_info:
+        services["Dnsmasq"] = {
+            "running": dnsmasq_info.get("service_active", False),
+        }
+    if wg_info:
+        services["WireGuard"] = {
+            "running": wg_info.get("up", False),
+        }
+    return services
+
+
 @app.route("/")
 def dashboard():
     active_zones = _safely(get_active_zones, {})
@@ -140,6 +154,7 @@ def dashboard():
         domains=domains,
         certs=certs,
         wg_status=wg,
+        services=_get_service_status(dnsmasq, wg),
     )