fix(certificates): убрать stale SSL-хосты и вернуть Save в FormSheet

Группы с health-check без verify_tls исключаются из мониторинга сертификатов; list/summary чистят stale. FormSheet — sticky footer со скроллом тела.

Co-authored-by: Cursor <[email protected]>

apps/api/src/services/certificate-service.ts

@@ -21,10 +21,19 @@ export interface CertificateTarget {
   hostname: string;
 }
 
+function pruneStaleCertificates(db: Db): void {
+  const targets = resolveCertificateTargets(db);
+  repos.deleteCertificatesNotIn(
+    db,
+    targets.map((t) => t.hostname),
+  );
+}
+
 export function listCertificates(
   db: Db,
   status?: string,
 ): Certificate[] {
+  pruneStaleCertificates(db);
   return repos.listCertificates(db, status);
 }
 
@@ -133,6 +142,13 @@ function bindingSubdomain(
   return repos.findSubdomainByDomainAndName(db, domainId, hostname);
 }
 
+/** Health-check without TLS verify implies invalid certs — skip SSL monitoring. */
+function skipsSslDueToHealthTls(
+  group: { health_check_enabled: boolean; health_check_verify_tls: boolean } | null,
+): boolean {
+  return Boolean(group?.health_check_enabled && !group.health_check_verify_tls);
+}
+
 export function buildServiceCertificateFqdns(
   db: Db,
 ): Map<string, CertificateTarget> {
@@ -144,6 +160,7 @@ export function buildServiceCertificateFqdns(
       ? repos.getServiceGroup(db, service.service_group_id)
       : null;
     if (!shouldMonitorService(service, group)) continue;
+    if (skipsSslDueToHealthTls(group)) continue;
 
     const subdomain = bindingSubdomain(db, binding.domain_id, binding.hostname);
     if (subdomain && !subdomain.enabled) continue;
@@ -159,6 +176,7 @@ export function buildServiceCertificateFqdns(
   const knownZones = repos.listAllDomains(db).map((d) => d.zone_name);
   for (const group of repos.listServiceGroups(db)) {
     if (!group.enabled || !group.domain?.trim()) continue;
+    if (skipsSslDueToHealthTls(group)) continue;
 
     const parsed = parseFqdn(group.domain, knownZones);
     if (!parsed) continue;
@@ -244,5 +262,6 @@ export async function runAllChecks(db: Db): Promise<number> {
 }
 
 export function statusSummary(db: Db): Array<[string, number]> {
+  pruneStaleCertificates(db);
   return repos.countCertificatesByStatus(db);
 }