fix(traefik): a renewed certificate is old, and list_certificates is bounded (#5864)

A Traefik that hasn't restarted keeps reporting the certificate it
replaced, so codex.fabledsword.com's old one (21 days left) was listed
beside its renewal (81 days) and would have raised an expiry warning on
2026-10-22. A reported certificate whose every name a later-expiring
one covers is now old, on the page, the widget, the overview and MCP.

list_certificates takes `limit` (default 100) with total/truncated, and
says how many served certificates no HTTP router uses (`unrouted`).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/plugins/traefik/test_traefik_page.py

@@ -175,6 +175,19 @@ def test_a_certificate_traefik_stopped_reporting_is_old_not_current():
     assert current_certs([], 60) == ([], [])
 
 
+def test_a_certificate_a_later_one_renewed_is_old_though_traefik_still_reports_it():
+    """codex.fabledsword.com on 2026-10-15: the replaced certificate (21 days
+    left) still reported beside its renewal (81 days), #5864."""
+    from plugins.traefik.routes import current_certs
+    old_one, renewal = _cert("1", "codex.example", 21), _cert("2", "codex.example", 81)
+    wider = _cert("3", "a.example", 90, sans="a.example,b.example")
+    narrower = _cert("4", "b.example", 30)
+    unrelated = _cert("5", "c.example", 10)
+    served, old = current_certs([old_one, renewal, wider, narrower, unrelated], 60)
+    assert {c.serial for c in served} == {"2", "3", "5"}
+    assert {c.serial for c in old} == {"1", "4"}
+
+
 def test_each_router_gets_the_soonest_certificate_for_its_hosts():
     from plugins.traefik.routes import certs_by_router
     now = datetime.now(timezone.utc)