fix: install.sh loop abort, ACME poll sudo gate, /static/ sub-paths

- install.sh: the traversal-chmod loop assigned _d but looped over the
  never-set $d; under set -u every fresh install aborted with
  "d: unbound variable" at that line. Loop over $_d.
- acme collector: the self-heal normalize (sudo chmod g+rwX) now runs
  only when a no-sudo group-read-bit probe detects a lost bit — acme.sh
  re-hardens the tree 600 on every run, so the steady-state poll makes
  no sudo call. The group bit (not daemon readability) is what the
  two-user model keeps for the WebUI user.
- lib.acme: new get_acme_home() accessor (ACME_HOME env, default
  data/acme), reused by _run_acme; _summarize_acme_output preserves a
  "Permission denied" line even when it is not among the final two, so
  the collector's actionable-error matcher keeps firing.
- nginx template: emit location /static/ for any is_management path
  (not only '/'); the SPA references /static/... at the domain root
  regardless of the management backend path.
- tests: probe, summarizer, and nginx-subpath cases in
  test_state.py, test_acme.py, test_nginx.py.

scripts/install.sh

@@ -253,9 +253,9 @@ mkdir -p /etc/dnsmasq
 chmod -R a+rX "${PROJECT_DIR}/webui/static"
 # ...and traversal (x only) up the parent chain, so repo-in-$HOME installs work.
 _d="${PROJECT_DIR}"
-while [[ "$d" != "/" && -n "$d" ]]; do
-    chmod a+x "$d" 2>/dev/null || true
-    d="$(dirname "$d")"
+while [[ "$_d" != "/" && -n "$_d" ]]; do
+    chmod a+x "$_d" 2>/dev/null || true
+    _d="$(dirname "$_d")"
 done
 # Set ownership: daemon owns project dir in prod, repo owner keeps ownership in dev.
 # The top-level .git (directory or worktree pointer file) is left untouched so