fix: ACME cert list self-heals when account.conf is left owner-only

The startup normalize and _run_acme_preflight covered daemon startup and issue/renew, but the recurring collector poll called lib.acme.list_certs() without normalizing ACME_HOME. A non-daemon run (e.g. a manual run as the WebUI user) re-creating account.conf owner-only made every acme.sh --list exit 2, so the collector returned certs=[] and the UI showed no certs until the next issue/renew or daemon restart.

- collector: normalize_acme_home() before list_certs() so the poll self-heals
- issue pre-check: normalize before the direct lib.acme.list_certs()
- _parse_account_conf: read acme.sh v3 account.conf (not just .account.conf)
- _collect_acme: actionable status.error for the account.conf perm case
- install.sh: chown ACME_HOME conf files to the daemon user

daemon/handlers/acme.py

@@ -807,8 +807,11 @@ async def issue_cert(_request: Any, body: dict[str, Any] | None) -> dict[str, An
                 "status": "existing",
             }
 
-    # Check if cert already exists — call acme.sh directly, not via state
+    # Check if cert already exists — call acme.sh directly, not via state.
+    # Normalize ACME_HOME first (same reason as the preflight): a prior run by
+    # another user can leave account.conf owner-only and make `--list` exit 2.
     try:
+        normalize_acme_home()
         certs = lib.acme.list_certs()
     except RuntimeError as exc:
         raise RuntimeError(f"Cannot check existing certificates: {exc}") from exc