[cppla]

Problem and behavior

A failed certificate check could retain a previous expiry timestamp, allowing the dashboard to show a healthy certificate after DNS, connection, or TLS failures. Reloading an unchanged certificate or changing its interval/callback could also preserve the previous check time and delay a new check.

Changes

• Clear stale expiry and hostname-mismatch results on check failure; successful checks clear the error and publish the current certificate.
• Reset certificate check state on configuration application so the next scheduler tick checks again, while preserving notification cooldowns.
• Discard results from checks started before a reload or removal/recreation of the same certificate key.
• Use one error-first status classification for the certificate table, mobile cards, and overview; show pending checks explicitly and hide stale expiry details on errors.

Validation

• Go 1.26.2: go test -race ./..., go vet ./..., and CGO_ENABLED=0 go build -trimpath passed.
• Chromium: all 10 Playwright tests passed, including desktop/mobile SSL state matrices and success → failure → recovery polling.
• Added backend regression tests cover TLS failure, connection refusal, recovery, unchanged reload, interval/callback changes, cooldown preservation, and old in-flight results.
• The new backend tests reproduced the failures on the original master (with one test call adapted to the old function signature); all four new browser tests failed there as expected.
• Formatting, JavaScript syntax, and clean patch application checks passed.

The current status.sh restart function only invokes systemctl restart status-server; it is unchanged. The reporter's installed script/service version and live DNS environment were not available for deployment verification. Local Docker deployment tests were not run because Docker was unavailable; repository CI will run those checks.

Fixes #297

[Copilot]

🟢 Approval recommended

No active review issues were identified for the SSL certificate status changes.

No open issues 🎉

What changed in this PR

Fixes stale SSL certificate status reported in #297 by clearing failed check results, refreshing checks after configuration reloads, and displaying consistent status across the dashboard.

Changes:

• Reset certificate check state on reload while preserving notification cooldowns and discarding outdated in-flight results.
• Unify error, pending, and expiry status across desktop tables, mobile cards, and overview counts.
• Add backend and browser regression coverage for failures, recovery, reloads, and status updates.

File	Description
web/​js/​app.js	Centralizes SSL status classification and hides stale expiry details on errors.
tests/​webui/​ssl.spec.js	Tests desktop/mobile status states and polling through failure and recovery.
server/​ssl.go	Clears failed results, resets state on reload, and rejects obsolete check results.
server/​ssl_test.go	Tests failure recovery, reload behavior, cooldown preservation, and in-flight checks.

_{Review effort: Balanced}