Show site certificate

Returns the site's SSL certificate summary as a meta-only JSON:API document (a computed structure, not a resource): `200` with `{"meta": {...}, "jsonapi": {"version": "1.1"}}`. `meta` keys, in order: `site_id` (integer), `configured` (boolean), `enabled` (boolean|null), `ssl_status` (`up` / `down` / `unknown` / null), `issuer` (`{cn, o, c, ou}`|null), `subject` (`{cn, o, c, ou}`|null), `valid_from` (string|null), `valid_to` (string|null), `days_until_expiry` (integer|null, negative once expired), `protocol` (string|null, e.g. `TLSv1.3`) and `sans` (string array|null). Example body: ```json {"meta":{"site_id":12345,"configured":true,"enabled":true,"ssl_status":"up","issuer":{"cn":"R11","o":"Let's Encrypt","c":"US","ou":null},"subject":{"cn":"example.com","o":null,"c":null,"ou":null},"valid_from":"2026-01-01 00:00:00","valid_to":"2026-03-12 12:00:00","days_until_expiry":30,"protocol":"TLSv1.3","sans":["example.com","www.example.com"]},"jsonapi":{"version":"1.1"}} ``` Path variable `site` is the exact site id (e.g. `12345`). A site without a certificate service answers 200 with `configured: false` and every other field null. This endpoint accepts **no query parameters at all**: any key (`filter`, `sort`, `page`, `include`, `fields`, anything) answers 422. Sites of other organizations — and members without the certificate read permission — answer 404. A read-only token is enough. The MCP twin of this endpoint is the `sites-certificate-show` tool.