v1.4.3 — TLS Watchlist fixes

Fixes in v1.4.3

TLS Watchlist — self-signed / untrusted cert detection

Self-signed and certs with untrusted CA were incorrectly shown as valid (green). Fixed:

• SSL exception catching now covers all ssl.SSLError subclasses (not just SSLCertVerificationError)
• Such certs now display as "⚠ Invalid / untrusted cert" in orange
• Sidebar dot turns orange when an untrusted cert is detected

TLS Watchlist — clearer status text

• Entries show "… (checking)" while the background worker is running
• Unreachable hosts show "— (unreachable)" instead of the ambiguous "not checked"