feat(deploy): announce the HTTP-only certificate window in the deploy log

[Farahat612]

A freshly routed domain answers on HTTP immediately, but the edge only
emits its :443 block once the certificate is on disk: so for the ~1
minute certbot takes, HTTPS is dark and the deploy log said nothing
about it. The pipeline is correct; the silence made it look broken, and
it has been reported as an SSL bug more than once (TODO.md item).

createTrackedSslProvider now runs the provider's read-only verifyCert
before issuing: reason "missing" is the same certsExist() gate the edge
uses, i.e. the genuine dark window. In that state the log announces
" is live on HTTP: provisioning the certificate, HTTPS in ~1
min." and, when issuance lands, "SSL certificate issued: is now
live on HTTPS." A redeploy with a cert already on disk keeps the old
wording and never claims a window that doesn't exist. Both verified-row
failure lines now carry the provider's own failure summary (Reason: …)
instead of ending at "will retry in the background". Issuance stays
best-effort; no deploy semantics change.

Tests cover the three states at the createTrackedSslProvider seam: the
dark-window announcement + HTTPS confirmation, the no-false-claim
redeploy, and the certbot summary reaching the log. Removes the resolved
TODO.md subsection.

Implements the TODO.md item "SSL provisioning is invisible in the deploy log"
as written there (the roughly one-minute HTTP-only window keeps being
reported as an SSL bug). The provisioning line only fires when verifyCert
reports the certificate genuinely missing, the same certsExist() state that
gates the :443 vhost, so a redeploy with a live certificate never claims a
dark window. Failure lines now carry the provider's own summary
(summarizeCertbotFailure output) instead of ending at "will retry in the
background". Issuance stays best-effort; no deploy semantics change. Removes
the resolved TODO section.

How verified: three tests at the createTrackedSslProvider seam (the
announcement plus HTTPS confirmation, the no-false-claim redeploy, and the
certbot summary reaching the log); they fail on main. Full apps/api suite
green (2996 tests), typecheck clean.