feat: add ACME account management with validation pipeline

- Register, view, and deactivate ACME accounts via API and UI
- 16-check validation framework for certificate issuance readiness
- DNS resolution, port, nginx, and firewall pre-flight checks
- External IP detection with NAT support and fallback providers
- Account card and settings modal in certificates page
- Guard certificate issuance behind account registration
- Update modal CSS to overlay-based approach
- 1000+ lines of tests for validation and account handlers

docs/deployment.md

@@ -25,14 +25,13 @@ Download the Vacuum Wall repository onto the target machine, then run the instal
 # Production: all env vars
 MGMT_DOMAIN=wall.example.com \
 MGMT_PASS="strongpassword" \
-ACME_EMAIL="admin@example.com" \
 ./install.sh --user vacuum-wall
 
 # Dev mode: CLI flags, auto-detects repo owner
-./install.sh --dev --mgmt-pass strongpassword --acme-email "admin@example.com"
+./install.sh --dev --mgmt-pass strongpassword
 
 # mDNS (LAN-only, no DNS record needed)
-./install.sh --mgmt-domain vacuum-wall.local --mgmt-pass strongpass --acme-email "me@example.com"
+./install.sh --mgmt-domain vacuum-wall.local --mgmt-pass strongpass
 ```
 
 ### Options
@@ -45,7 +44,6 @@ All settings that can be passed as an environment variable also have a CLI flag
 | `--mgmt-domain` | `MGMT_DOMAIN` | No | (same as above) |
 | `--mgmt-pass` | `MGMT_PASS` | Yes | Password for HTTP basic auth protecting the WebUI. |
 | `--mgmt-user` | `MGMT_USER` | No | Username for WebUI access. Defaults to `admin`. |
-| `--acme-email` | `ACME_EMAIL` | Yes | Email for ACME provider (ZeroSSL by default). |
 | `--user, -u` | `USER_NAME` | Yes* | WebUI service user (created if it does not exist). Required for non-dev mode. In `--dev` mode, auto-detected from repo owner. |
 | `--path, -p` | `INSTALL_DIR` | No | Install directory. Defaults to repo root. Set to deploy from a custom path (e.g., `/opt/vacuum-wall`). |
 | `--dev` | -- | No | Development mode: auto-detects repo owner as service user, skips safety warning. |
@@ -73,7 +71,7 @@ In dev mode, the ownership model preserves the developer's ability to work with
 ### Running the Installer in Dev Mode
 
 ```bash
-./install.sh --dev --mgmt-pass strongpassword --acme-email "dev@example.com"
+./install.sh --dev --mgmt-pass strongpassword
 ```
 
 The script detects the repo owner (e.g., `wall`), creates the `vacuum-walld` daemon user with the repo owner's primary group, and sets up the ownership model described above.
@@ -91,8 +89,7 @@ You can deploy Vacuum Wall in a container or at any custom path. Use `--path` (o
 ```bash
 # Docker volume mount example
 ./install.sh --path /app/vacuum-wall --user ww-app \
-    --mgmt-domain proxy.internal --mgmt-pass strongpassword \
-    --acme-email "admin@example.com"
+    --mgmt-domain proxy.internal --mgmt-pass strongpassword
 ```
 
 The systemd service unit files and sudoers whitelist are rendered from Jinja2 templates at install time, substituting `USER_NAME` and `INSTALL_DIR`. This means no hardcoded paths remain after installation.
@@ -130,7 +127,7 @@ The installer performs the following steps automatically:
   - `internal` — trusted LAN zone with DHCP, DNS, and NTP services allowed.
   - `vpn` — WireGuard tunnel zone.
 - **Service startup**: Enables and starts/restarts nginx, the daemon (`vacuum-walld`), the WebUI (`vacuum-wall`), and the ACME renewal timer. nginx is reloaded (or restarted) to pick up any config changes.
-- **ACME registration**: Registers the ACME account with the provided email via acme.sh.
+- **ACME account**: No account registration during install. Register the account via the WebUI after first login.
 
 ### Idempotent Re-Runs
 
@@ -308,7 +305,7 @@ ACME validation via the ACME provider requires:
 
 - The domain's DNS A record points to the appliance's public IP.
 - Port 80 (HTTP-01 challenge) is accessible from the internet on the external interface.
-- The ACME email was registered correctly. Check with:
+- An ACME account is registered (check the Certs page in the WebUI). Verify with:
 
 ```bash
 su -s /bin/bash "$USER_DAEMON_NAME" -c "~/data/acme/acme.sh --list"