feat(gateway): DNS credential verification and cert attempt observability

[Leechael]

Summary

Two admin-facing observability additions for the gateway's certificate lifecycle:

• VerifyDnsCredential admin RPC — read-only check of a DNS credential against the provider API. Reports the Cloudflare token status (active/expired/disabled/invalid), the granted permission groups, whether issuance requirements (Zone Read, DNS Write) are covered, and zone resolution for every domain referencing the credential (directly or via the default-credential fallback). Today an invalid or under-privileged token only surfaces as a log line during the next renewal attempt.
• Per-domain cert attempt status — certificate issuance/renewal runs as a background task whose failures only reach the logs. DistributedCertBot now keeps a node-local, in-memory record per domain (last attempt time and node, last success, consecutive failures, truncated error chain of the last failure). Exposed by extending ZtDomainCertStatus, so existing GetZtDomain/ListZtDomains return it without a new RPC. try_renew and init_domain both record outcomes; nodes that skip because a peer holds the renew lock do not write.

Design notes

• Token permissions are queried, not probed: GET /user/tokens/verify yields the token id, then GET /user/tokens/{id} returns the granted permission groups. No DNS records are created or removed.
• Attempt status is in-memory (node-local) by design: current deployments are single-node. The response shape is storage-agnostic, so the record can later move into WaveKV for multi-node visibility without API changes. If this lands after feat(gateway): upgrade to wavekv 2.0 delta-state sync #1031, no schema interaction is needed since nothing new is written to WaveKV.
• Error chains are truncated to 16 KiB keeping head and tail — upstream gateway errors (e.g. Cloudflare 502 pages) are full HTML documents.

Test plan

• cargo test -p dstack-gateway -p certbot — 161 passed, including new unit tests for permission matching, error truncation, and attempt-status tracking
• End-to-end against tools/mock-cf-dns-api (extended with /user/tokens/verify and /user/tokens/{id}, plus MOCK_TOKEN_STATUS/MOCK_TOKEN_PERMISSIONS knobs): token verify, permission group parsing, zone resolution, and unknown-zone failure all verified
• cargo clippy clean, prek run --all-files clean
• Live gateway against real Cloudflare token