feat(domains): show how each server renews certificates on the Domains page

[agentHits]

Why

Certificates are renewed only through port 443 (tlsChallenge), but the panel never showed it. An old server could still have httpChallenge in traefik.yml or publish port 80, and nothing pointed that out until a renewal failed.

What

The Domains page now opens with a Certificate renewal table. It has one row for the panel and one for each server:

Column	Shows
Method	The ACME challenge in traefik.yml: TLS-ALPN-01 on 443, HTTP-01 (needs port 80), DNS-01, or none
Published ports	Host ports of the dokploy-traefik container or swarm service, and whether port 80 is open. Configured bindings are read, so a stopped container still shows them
What to do	For httpChallenge, an open port 80 or a missing 443/tcp: the fix (save the Traefik port mappings once; that converts the config and recreates Traefik)

There is no switch, because the only other method needs port 80, which stays closed.

The check is one more stage of the existing per-server read (readServer). It does not affect usageVerified, so it never hides the unused-certificate list. docs/certificates-and-ports.md describes the table.

Independent of #71.

Tests

• certificate-renewal.test.ts runs the real shell command with a fake docker and a temporary traefik.yml. Cases:
  • standalone container;
  • swarm service;
  • httpChallenge together with port 80;
  • 443/tcp missing;
  • config or Traefik missing;
  • a commented-out httpChallenge;
  • bindings without a host port.
• The domain overview suite fakes the new command and checks that certificateRenewal reaches the page data.
• All 25 domain-overview test files pass. apps/dokploy typecheck passes.

🤖 Generated with Claude Code