fix(vhosts): make SSL cert path validate and serve a real default cert

[bihius]

Adding an SSL/Let's Encrypt vhost failed POST /config/apply with a "request failed" banner. The backend logged:

config-apply validation failed ... unable to stat SSL certificate from file
'/etc/haproxy/generated/certs/' : No such file or directory.

Root cause — two independent defects

Both reproduced and verified against a live stack.

1. Fabricated default certificate. The fallback default.pem written by _write_candidate was hand-typed base64, not a real PEM. Even with the path fixed, haproxy -c rejects it with unable to load certificate ... too long.

2. Unresolvable cert path during validation. The template bakes in the absolute path /etc/haproxy/generated/certs/, but:

   • the backend (where haproxy -c validation runs) mounts the shared generated_config volume at /var/lib/guard-proxy/generated, so that path does not exist there;
   • certificates were written per-release (<release>/certs/), not at the directory the template points to.

Fix

• Generate a real self-signed default.pem via cryptography (already a dependency), written once and reused (idempotent). SNI selects the real certificate when present and falls back to this one otherwise — so an SSL vhost validates even before its Let's Encrypt certificate is provisioned.
• Write certificates to a single shared <root>/certs directory (not per-release), matching the absolute path baked into haproxy.cfg.
• Alias /etc/haproxy/generated to the backend mount point in the backend image so haproxy -c resolves the same shared volume HAProxy uses at runtime.

The shared generated_config volume and all mounts are unchanged — no change to mount points, RUNTIME_GENERATED_CONFIG_ROOT, or the HAProxy command/healthcheck.

Tests

• ruff check app/, mypy app/, pytest --cov — all green (393 passed).
• New regression tests: default cert is loadable as a real cert + key, generation is idempotent, and certs land in the shared directory with a fallback default.

Verification

End-to-end on a live backend container: symlink resolution + cryptography-generated default cert + haproxy -c on an SSL bind → passes. Full live deploy + real Let's Encrypt vhost test still pending (requires rebuilding the backend image on the target host).