feat(checks): wire up TLS certificate expiry monitoring

The ontology declared monitoring [cert-expiry] on the certificate type and a
working checkCertExpiry probe existed, but checkdefaults had no cert-expiry
builder and no certificate entities were seeded — so certificate expiry, a
real failure mode, was invisible.

Add a KindCertExpiry builder (dials the cert's hostname on :443 hourly, warns
at 30d / crit at 7d) and seed certificate entities for the 20 public
*.hubris.network routes plus uses-certificate edges from each ingress route.

internal/checkdefaults/defaults.go

@@ -24,13 +24,14 @@ import (
 // check_defs.kind values — one semantic kind can expand to several concrete
 // checks (`resource` becomes four ssh-script rows).
 const (
-	KindPing     = "ping"
-	KindResource = "resource"
-	KindUpdates  = "updates"
-	KindProcess  = "process"
-	KindHTTP     = "http"
-	KindCapacity = "capacity"
-	KindBackup   = "backup-freshness"
+	KindPing       = "ping"
+	KindResource   = "resource"
+	KindUpdates    = "updates"
+	KindProcess    = "process"
+	KindHTTP       = "http"
+	KindCapacity   = "capacity"
+	KindBackup     = "backup-freshness"
+	KindCertExpiry = "cert-expiry"
 )
 
 // defaultBackupMaxAge is how long a backup target may go without a new
@@ -246,11 +247,40 @@ func buildKind(kind string, t Target, attrs map[string]any, host, user string, p
 			config:   map[string]any{"url": url, "max_status": 500},
 			interval: 60,
 		}}, ""
+
+	case KindCertExpiry:
+		// The host to TLS-dial for the cert. Prefer an explicit `hostname`
+		// attribute, then `cn`, then a dotted name (a certificate's name is
+		// its CN/SAN). Hourly: expiry changes once a day, but a renewal or a
+		// mis-issued cert is worth noticing within the hour.
+		host := certHost(t, attrs)
+		if host == "" {
+			return nil, "no hostname / cn / dotted name to dial for the cert"
+		}
+		return []checkDef{{
+			kind:     "cert-expiry",
+			config:   map[string]any{"host": host, "warn_days": 30, "crit_days": 7},
+			interval: 3600,
+		}}, ""
 	}
 
 	return nil, "no builder for this kind yet"
 }
 
+// certHost works out the hostname to TLS-dial for a certificate's expiry.
+func certHost(t Target, attrs map[string]any) string {
+	for _, key := range []string{"hostname", "cn", "san"} {
+		if v, ok := attrs[key].(string); ok && v != "" {
+			return v
+		}
+	}
+	// A dotted name is a hostname (hubris.network, media.hubris.network).
+	if strings.Contains(t.Name, ".") && !strings.Contains(t.Name, " ") {
+		return t.Name
+	}
+	return ""
+}
+
 // writeCheck upserts one check_def and its backing check entity.
 //
 // The entity upsert MUST return the row's id. The previous version generated