Add SSL certificate provisioning button for superadmin

- New provision_ssl API endpoint runs certbot for new domains
- SSL button appears next to domain textarea for superadmin
- Shell script on server handles Apache config + Let's Encrypt
- DNS check skips domains without resolution to avoid certbot errors

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

api.php

@@ -4256,6 +4256,38 @@ switch ($action) {
         echo json_encode(['success' => true]);
         break;
 
+    case 'provision_ssl':
+        requireSuperAdmin();
+        if ($method !== 'POST') break;
+        $input = json_decode(file_get_contents('php://input'), true);
+        $domains = $input['domains'] ?? [];
+        if (empty($domains)) {
+            http_response_code(400);
+            echo json_encode(['error' => 'Domainit puuttuvat']);
+            break;
+        }
+        // Validoi domainit
+        foreach ($domains as $d) {
+            if (!preg_match('/^[a-z0-9.-]+\.[a-z]{2,}$/', $d)) {
+                http_response_code(400);
+                echo json_encode(['error' => "Virheellinen domain: $d"]);
+                break 2;
+            }
+        }
+        // Suorita provisiointi shell-skriptinä
+        $escapedDomains = array_map('escapeshellarg', $domains);
+        $domainList = implode(' ', $escapedDomains);
+        $output = [];
+        $exitCode = 0;
+        exec("sudo /usr/local/bin/provision-ssl.sh $domainList 2>&1", $output, $exitCode);
+        if ($exitCode !== 0) {
+            http_response_code(500);
+            echo json_encode(['error' => 'SSL-provisiointi epäonnistui: ' . implode("\n", $output)]);
+        } else {
+            echo json_encode(['success' => true, 'message' => 'SSL-sertifikaatti päivitetty: ' . implode(', ', $domains)]);
+        }
+        break;
+
     case 'company_switch':
         requireAuth();
         if ($method !== 'POST') break;