fix: ECC cert support, ACME deploy hook path, NAT detection, and account config fallback

- Add find_cert_dir() to resolve both RSA and ECC (domain_ecc/) cert dirs
- Copy acme deploy hook to /deploy/ where acme.sh resolves it
- _parse_account_conf checks both legacy .account.conf and declarative config
- Skip public DNS check when all local IPs are private (NAT)
- Improve check message strings for validity and expiry status
- Support timezone-aware date formats in _days_until parsing
- Filter out "no" SAN domains in cert listing
- Bump frontend asset version cache keys
- Fix DOMContentLoaded race condition in app.js boot
- Fix spread operator in certs.js modal template

install.sh

@@ -218,8 +218,12 @@ else
     log "acme.sh already installed."
 fi
 
-# Ensure the acme deploy hook script has correct permissions
-chmod 0755 "${PROJECT_DIR}/system/acme-deploy.sh"
+# Install the deploy hook into acme.sh's deploy directory
+# (acme.sh only resolves hooks from $ACME_HOME/deploy/)
+mkdir -p "$ACME_HOME/deploy"
+cp "${PROJECT_DIR}/system/acme-deploy.sh" "$ACME_HOME/deploy/acme-deploy.sh"
+chown "$USER_DAEMON_NAME:$USER_GROUP" "$ACME_HOME/deploy/acme-deploy.sh"
+chmod 0755 "$ACME_HOME/deploy/acme-deploy.sh"
 
 # --- 3. Setup directories ---
 log "Creating config and data directories..."