fix(frontend): polish cert dialog and wire upload API

Prefer drag-and-drop for crt/key with PEM paste collapsed; rename
primary actions; add HTTP-01 prechecks. Upload posts to
POST /system/tls/certificate with cert_source from status.

frontend/src/locales/en-US.json

@@ -972,7 +972,13 @@
     "http01Hint": "Let’s Encrypt HTTP-01. Port 80 must be reachable. Auto-renewal status appears in the list.",
     "certKeyRequired": "Certificate and private key are required",
     "certUploaded": "Certificate uploaded",
-    "uploadApiPending": "Upload API is not ready yet (POST /system/tls/certificate). Use HTTP-01 for now."
+    "uploadApiPending": "Upload API is not ready yet (POST /system/tls/certificate). Use HTTP-01 for now.",
+    "dropHint": "Drop a file here, or click to choose",
+    "pastePem": "Or paste PEM text",
+    "importCert": "Import certificate",
+    "startIssue": "Start issuance",
+    "http01CheckDns": "DNS already points to this public entry",
+    "http01CheckPort": "Issuance port is reachable (usually 80, or matches entry port)"
   },
   "feishuSync": {
     "title": "Feishu directory",