Issue dashboard SSL per tenant instead of full cert sync.

Per-row Issue SSL now runs ssl-issue-tenant.sh for business/customer hosts only, with nginx cert map support, so one broken tenant cannot block others.

Co-authored-by: Cursor <cursoragent@cursor.com>

deploy/meshkee-dashboard-certs-map.conf

@@ -0,0 +1,9 @@
+# Per-tenant dashboard cert paths (default → shared meshkee-dashboards cert).
+# Tenant rows are appended by deploy/ssl-issue-tenant.sh when Issue SSL runs for one domain.
+map $host $meshkee_dashboard_ssl_cert {
+    default /etc/letsencrypt/live/meshkee-dashboards/fullchain.pem;
+}
+
+map $host $meshkee_dashboard_ssl_key {
+    default /etc/letsencrypt/live/meshkee-dashboards/privkey.pem;
+}