feat(cert): dial the TLS terminator directly so cert-expiry works from the container

checkCertExpiry now accepts a `dial` address and sets ServerName to the
hostname — it connects to the terminator's IP while SNI/cert-read use the
hostname. The scheduler container has no mesh interface and the host resolver
doesn't know the split-horizon zone, so *.hubris.network can't be dialed by
name from there; dialing Caddy's lab IP (reachable on the LAN) makes the probe
work. The builder passes through a cert entity's `dial` attribute.

Re-seed the 20 *.hubris.network certificate entities with dial=192.168.8.175
(Caddy) and uses-certificate edges; cert-expiry monitoring now has real data.

internal/scheduler/scheduler.go

@@ -536,6 +536,12 @@ func checkDisk(ctx context.Context, cd sqlcgen.ListEnabledCheckDefsRow) checkRes
 func checkCertExpiry(ctx context.Context, cd sqlcgen.ListEnabledCheckDefsRow) checkResult {
 	cfg := struct {
 		Host     string `json:"host"`
+		// Dial is an optional explicit dial address (the TLS terminator's IP)
+		// for when the hostname doesn't resolve/reach from the scheduler — the
+		// container has no mesh interface and the host resolver doesn't know
+		// the split-horizon zone, so *.hubris.network dials Caddy's lab IP
+		// directly while SNI/cert-read still uses Host.
+		Dial     string `json:"dial"`
 		Port     int    `json:"port"`
 		WarnDays int    `json:"warn_days"`
 		CritDays int    `json:"crit_days"`
@@ -556,9 +562,13 @@ func checkCertExpiry(ctx context.Context, cd sqlcgen.ListEnabledCheckDefsRow) ch
 		timeout = 30 * time.Second
 	}
 
-	addr := net.JoinHostPort(cfg.Host, fmt.Sprintf("%d", cfg.Port))
+	dialHost := cfg.Host
+	if cfg.Dial != "" {
+		dialHost = cfg.Dial
+	}
+	addr := net.JoinHostPort(dialHost, fmt.Sprintf("%d", cfg.Port))
 
-	d := tls.Dialer{Config: &tls.Config{InsecureSkipVerify: true}}
+	d := tls.Dialer{Config: &tls.Config{InsecureSkipVerify: true, ServerName: cfg.Host}}
 	conn, err := d.DialContext(ctx, "tcp", addr)
 	if err != nil {
 		return checkResult{