fix: ACME cert list self-heals when account.conf is left owner-only

The startup normalize and _run_acme_preflight covered daemon startup and issue/renew, but the recurring collector poll called lib.acme.list_certs() without normalizing ACME_HOME. A non-daemon run (e.g. a manual run as the WebUI user) re-creating account.conf owner-only made every acme.sh --list exit 2, so the collector returned certs=[] and the UI showed no certs until the next issue/renew or daemon restart.

- collector: normalize_acme_home() before list_certs() so the poll self-heals
- issue pre-check: normalize before the direct lib.acme.list_certs()
- _parse_account_conf: read acme.sh v3 account.conf (not just .account.conf)
- _collect_acme: actionable status.error for the account.conf perm case
- install.sh: chown ACME_HOME conf files to the daemon user

scripts/install.sh

@@ -231,6 +231,16 @@ mkdir -p "$ACME_HOME/deploy"
 cp "${PROJECT_DIR}/system/acme-deploy.sh" "$ACME_HOME/deploy/acme-deploy.sh"
 chown "$USER_DAEMON_NAME:$USER_GROUP" "$ACME_HOME/deploy/acme-deploy.sh"
 chmod 0755 "$ACME_HOME/deploy/acme-deploy.sh"
+# Ensure the daemon user owns acme.sh's runtime conf files (account.conf and
+# any per-domain .conf). acme.sh hardens these owner-only (600); if a
+# non-daemon user ever (re)creates them the daemon cannot source account.conf
+# and every acme.sh call exits 2. The daemon self-heals on the next run, but
+# fixing ownership here avoids the initial broken window on fresh installs.
+if [ -d "$ACME_HOME" ]; then
+    find "$ACME_HOME" -maxdepth 1 -type f -name '*.conf' \
+        -exec chown "$USER_DAEMON_NAME:$USER_GROUP" {} + 2>/dev/null || true
+    [ -f "$ACME_HOME/account.conf" ] && chmod 0640 "$ACME_HOME/account.conf"
+fi
 
 # --- 3. Setup directories ---
 log "Creating config and data directories..."