Fix API SSL startup

[Philreact]

1. SslUtils – hostname resolution (server cert SAN)
   Wrapped InetAddress.getLocalHost() and hostname/canonical usage in a try/catch.
   On any exception, log a warning and continue with a minimal SAN list: localhost, 127.0.0.1, and IPs from network interface enumeration (unchanged).
   Ensures server cert generation always completes on Pi/Mac and similar setups; SAN still includes loopback and LAN IPs.

2. ApiService – corrupt keystore handling
   When the keystore file exists and is readable, attempt to load it (with the default PKCS12 provider) before starting Jetty.
   If load fails (e.g. EOFException, corrupt format), log a warning, delete the bad file, call SslUtils.generateSsl(), then continue startup.
   Users no longer need to manually delete a corrupt keystore; the next startup recovers automatically.

3. SslUtils.createKeystore() – write with default PKCS12 provider
   Replaced KeyStore.getInstance("PKCS12", "BC") with KeyStore.getInstance("PKCS12") for the keystore used in createKeystore() (the one we write and store()).
   Keystore file is still standard PKCS12 (one key entry with cert chain).
   Avoids “JCE cannot authenticate the provider BC” during keyStore.store() on Oracle Java SE; cert/key generation in SslUtils still uses BC.

4. ApiService – load keystore with default provider
   Removed sslContextFactory.setKeyStoreProvider("BC") so Jetty loads the keystore with the default (e.g. SunJSSE) PKCS12 implementation.
   Pre-start validation of the keystore now also uses KeyStore.getInstance("PKCS12") (default provider) so validation matches Jetty and does not falsely treat a valid keystore as corrupt on JVMs where BC cannot load PKCS12.