fix(certificates): не мониторить SSL без health-check с TLS verify

Биндинги с выключенным health-check (imsk/mmsk) исключаются из авто-мониторинга; sticky footer в редактировании сервиса.

Co-authored-by: Cursor <[email protected]>

apps/api/test/certificates.test.ts

@@ -73,7 +73,17 @@ describe("certificates", () => {
     );
     const service = repos.createService(testApp.db, "Web", "web");
     repos.setServiceEnabled(testApp.db, service.id, true);
-    repos.insertBinding(testApp.db, domain.id, service.id, "api", null);
+    const binding = repos.insertBinding(
+      testApp.db,
+      domain.id,
+      service.id,
+      "api",
+      null,
+    );
+    repos.updateBindingLbConfig(testApp.db, binding.id, {
+      health_check_enabled: true,
+      health_check_verify_tls: true,
+    });
 
     const expiresAt = new Date(Date.now() + 90 * 24 * 60 * 60 * 1000);
     vi.spyOn(certificateService, "checkHostname").mockResolvedValue({
@@ -94,6 +104,76 @@ describe("certificates", () => {
     await testApp.close();
   });
 
+  it("does not monitor binding when health-check is off", async () => {
+    const testApp = await buildApp({
+      config: { ...loadConfig(), staticDir: null },
+      memory: true,
+    });
+    const headers = await authHeaders(testApp);
+
+    const domain = repos.createDomain(
+      testApp.db,
+      null,
+      "rkns.example.com",
+      "cf-zone-imsk",
+    );
+    const service = repos.createService(testApp.db, "Cname", "cname");
+    repos.setServiceEnabled(testApp.db, service.id, true);
+    const binding = repos.insertBinding(
+      testApp.db,
+      domain.id,
+      service.id,
+      "imsk",
+      null,
+    );
+    repos.setBindingCnameTarget(testApp.db, binding.id, "ihome.rkns.example.com");
+    repos.updateBindingLbConfig(testApp.db, binding.id, {
+      health_check_enabled: false,
+    });
+
+    repos.upsertCertificateCheck(
+      testApp.db,
+      domain.id,
+      null,
+      "imsk.rkns.example.com",
+      null,
+      CERT_ERROR,
+      "stale",
+    );
+
+    vi.spyOn(certificateService, "checkHostname").mockResolvedValue({
+      expiresAt: new Date(Date.now() + 90 * 24 * 60 * 60 * 1000),
+      error: null,
+    });
+
+    await testApp.inject({
+      method: "POST",
+      url: "/api/v1/certificates/check",
+      headers,
+    });
+
+    expect(
+      repos.listCertificates(testApp.db).some(
+        (c) => c.hostname === "imsk.rkns.example.com",
+      ),
+    ).toBe(false);
+    expect(certificateService.checkHostname).not.toHaveBeenCalled();
+
+    const listRes = await testApp.inject({
+      method: "GET",
+      url: "/api/v1/certificates",
+      headers,
+    });
+    expect(listRes.statusCode).toBe(200);
+    expect(
+      (listRes.json() as { hostname: string }[]).some(
+        (c) => c.hostname === "imsk.rkns.example.com",
+      ),
+    ).toBe(false);
+
+    await testApp.close();
+  });
+
   it("does not monitor host when service is disabled", async () => {
     const testApp = await buildApp({
       config: { ...loadConfig(), staticDir: null },