fix: don't show stale CA banner when no CA bundle exists

The self-signed bootstrap cert has no CA bundle, so newly created tenants
with ca_applied_at=NULL are not actually stale. Skip the count when the
active cert has hasCa=false.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/main/java/net/siegeln/cameleer/saas/certificate/CertificateService.java

@@ -132,6 +132,7 @@ public class CertificateService {
     public long countStaleTenants() {
         var active = certRepository.findByStatus(CertificateEntity.Status.ACTIVE).orElse(null);
         if (active == null || active.getActivatedAt() == null) return 0;
+        if (!active.isHasCa()) return 0; // no CA bundle to propagate
         return tenantRepository.countByCaAppliedAtBeforeOrCaAppliedAtIsNull(active.getActivatedAt());
     }