feat: HTTPS cert status, IDENTITY_CHANGED wiring, remove stale ip_utils Caddyfile writes

- CaddyManager: add refresh_cert_status() and get_cert_status_fresh() that
  open a live TLS connection to cell-caddy:443 to read cert expiry; avoids
  needing a volume mount into the API container
- CaddyManager: periodic cert refresh in health_monitor_loop (every 60 cycles)
- config.py PUT /api/ddns: publish IDENTITY_CHANGED so CaddyManager regenerates
  the Caddyfile immediately after any domain/cell_name change — previously the
  event was never fired from this route
- config.py: remove all ip_utils.write_caddyfile() calls; CaddyManager is now
  the sole authority for Caddyfile generation
- app.py: add GET /api/caddy/cert-status route
- app.py: add GET /api/egress/status and PUT /api/egress/services/<id>/exit routes
- Settings.jsx: display cert status badge (valid/expired/internal/unknown) with
  expiry date and days-remaining in the domain section
- Tests: TestRefreshCertStatus (8 tests), TestDdnsConfigUpdatesFiresIdentityChanged,
  TestCaddyCertStatusRoute added; fix expired-cert helper to set not_valid_before
  relative to expiry so it's always earlier

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

api/app.py

@@ -590,6 +590,7 @@ def perform_health_check():
         return {'error': str(e), 'timestamp': datetime.utcnow().isoformat()}
 
 def health_monitor_loop():
+    _cert_check_cycle = 0
     while health_monitor_running:
         with app.app_context():
             health_result = perform_health_check()
@@ -613,6 +614,14 @@ def health_monitor_loop():
                         caddy_manager.reset_health_failures()
             except Exception as _caddy_err:
                 logger.error("Caddy health monitor error: %s", _caddy_err)
+            # Refresh cert status every 60 cycles (\u2248 1 hour with a 60 s loop).
+            _cert_check_cycle += 1
+            if _cert_check_cycle >= 60:
+                _cert_check_cycle = 0
+                try:
+                    caddy_manager.refresh_cert_status()
+                except Exception as _cert_err:
+                    logger.warning("Cert status refresh failed (non-fatal): %s", _cert_err)
         time.sleep(60)  # Check every 60 seconds
 
 # Start health monitor thread
@@ -854,6 +863,21 @@ def connectivity_get_peer_exits():
         return jsonify({'error': str(e)}), 500
 
 
+@app.route('/api/caddy/cert-status', methods=['GET'])
+def caddy_cert_status():
+    """Return TLS certificate status (expiry, days remaining, status).
+
+    Refreshes from Caddy if the cached value is older than 5 minutes.
+    For LAN mode returns {'status': 'internal'}; for ACME modes returns
+    expiry info read via SSL handshake with the Caddy container.
+    """
+    try:
+        return jsonify(caddy_manager.get_cert_status_fresh(max_age_seconds=300))
+    except Exception as e:
+        logger.error(f"caddy_cert_status: {e}")
+        return jsonify({'error': str(e)}), 500
+
+
 @app.route('/api/egress/status', methods=['GET'])
 def egress_status():
     """Return egress status for all installed services that have an egress config."""