Add live TLS certificate probing and improve restart error handling.

Configure CertificateCheckUrl per container for curl-like TLS checks, classify Sonic permission errors, and extend setup wizard for container management.

Co-authored-by: Cursor <cursoragent@cursor.com>

ZA.CoreService.ESBCertificateManager/Services/DeployTargetRepository.cs

@@ -43,6 +43,7 @@ public sealed class DeploymentTargetRepository
                 container.[SonicContainerId],
                 container.[ContainerName],
                 container.[ContainerDisplayName],
+                container.[CertificateCheckUrl],
                 container.[RestartTimeoutSeconds],
 
                 connection.[ConnectionName],
@@ -119,6 +120,9 @@ public sealed class DeploymentTargetRepository
         int containerDisplayNameOrdinal =
             reader.GetOrdinal("ContainerDisplayName");
 
+        int certificateCheckUrlOrdinal =
+            reader.GetOrdinal("CertificateCheckUrl");
+
         int restartTimeoutOrdinal =
             reader.GetOrdinal("RestartTimeoutSeconds");
 
@@ -144,6 +148,11 @@ public sealed class DeploymentTargetRepository
                     reader,
                     containerDisplayNameOrdinal);
 
+            string? certificateCheckUrl =
+                ReadNullableString(
+                    reader,
+                    certificateCheckUrlOrdinal);
+
             string companyCode =
                 reader.GetString(companyCodeOrdinal);
 
@@ -152,6 +161,22 @@ public sealed class DeploymentTargetRepository
                     ? containerName
                     : containerDisplayName;
 
+            string tlsHost = string.Empty;
+            int? tlsPort = null;
+            string tlsServerName = string.Empty;
+
+            if (TlsEndpointProbeService.TryParseEndpoint(
+                    certificateCheckUrl,
+                    out string host,
+                    out int port,
+                    out string serverName,
+                    out _))
+            {
+                tlsHost = host;
+                tlsPort = port;
+                tlsServerName = serverName;
+            }
+
             targets.Add(new DeploymentTarget
             {
                 Id = reader.GetInt32(targetIdOrdinal),
@@ -188,11 +213,11 @@ public sealed class DeploymentTargetRepository
                 RestartTimeoutSeconds =
                     reader.GetInt32(restartTimeoutOrdinal),
 
-                TlsHost = string.Empty,
+                TlsHost = tlsHost,
 
-                TlsPort = null,
+                TlsPort = tlsPort,
 
-                TlsServerName = string.Empty,
+                TlsServerName = tlsServerName,
 
                 ExpectedFingerprint = null,