fix: services/status probe fails with self-signed certs when CA is missing in container

The /api/v1/services/status endpoint (dashboard card ON/OFF) uses an
HTTPS agent to probe each service. When /app/pki/root.crt is missing
inside the container, it fell back to new https.Agent() which rejects
self-signed certificates. This caused all .sami domain probes to fail
with UNABLE_TO_GET_ISSUER_CERT_LOCALLY, making dashboard cards randomly
flip between ON and OFF depending on whether the Pylon relay responded
before the 10s deadline.

Fix: use rejectUnauthorized: false as fallback when CA cert is absent.

dashcaddy-api/routes/services.js

@@ -54,7 +54,8 @@ module.exports = function({
     const caCert = fs.readFileSync(CA_CERT_PATH);
     probeHttpsAgent = new https.Agent({ ca: [...tls.rootCertificates, caCert] });
   } catch (_) {
-    probeHttpsAgent = new https.Agent();
+    // CA cert not available — trust self-signed certs so probes still work
+    probeHttpsAgent = new https.Agent({ rejectUnauthorized: false });
   }
 
   function isServiceUp(statusCode) {