fix: ECC cert support, ACME deploy hook path, NAT detection, and account config fallback

- Add find_cert_dir() to resolve both RSA and ECC (domain_ecc/) cert dirs
- Copy acme deploy hook to /deploy/ where acme.sh resolves it
- _parse_account_conf checks both legacy .account.conf and declarative config
- Skip public DNS check when all local IPs are private (NAT)
- Improve check message strings for validity and expiry status
- Support timezone-aware date formats in _days_until parsing
- Filter out "no" SAN domains in cert listing
- Bump frontend asset version cache keys
- Fix DOMContentLoaded race condition in app.js boot
- Fix spread operator in certs.js modal template

lib/state.py

@@ -702,7 +702,12 @@ def _resolve_ca_name(ca_server: str) -> str:
 
 
 def _parse_account_conf(acme_home: Path | None = None) -> dict[str, Any]:
-    """Parse acme.sh .account.conf and return account status dict.
+    """Parse acme.sh account information and return account status dict.
+
+    Checks three sources in order:
+      1. Legacy ``.account.conf`` file (acme.sh v2.x format)
+      2. Declarative ``config/acme/config.json`` (saved by the registration
+         handler with ``email`` and ``ca`` fields)
 
     Args:
         acme_home: Optional override for ACME home directory. Falls back
@@ -710,13 +715,12 @@ def _parse_account_conf(acme_home: Path | None = None) -> dict[str, Any]:
 
     Returns:
         Dict with ``registered``, ``email``, ``ca``, and
-        ``key_length`` keys.  If the file is missing or keys are absent,
-        ``registered`` is ``False`` with empty / ``None`` values.
+        ``key_length`` keys.  If no account is found, ``registered`` is
+        ``False`` with empty / ``None`` values.
     """
     if acme_home is None:
         acme_home_env = os.environ.get("ACME_HOME", str(PROJECT_DIR / "data" / "acme"))
         acme_home = Path(acme_home_env)
-    account_path = acme_home / ".account.conf"
 
     default = {
         "registered": False,
@@ -725,38 +729,56 @@ def _parse_account_conf(acme_home: Path | None = None) -> dict[str, Any]:
         "key_length": None,
     }
 
-    if not account_path.is_file():
-        return default
+    # 1. Legacy .account.conf (acme.sh v2.x)
+    account_path = acme_home / ".account.conf"
+    if account_path.is_file():
+        try:
+            text = account_path.read_text()
+        except OSError:
+            pass
+        else:
+            email = ""
+            ca_raw = ""
+            key_length = None
+            for line in text.splitlines():
+                if line.startswith("ACME_LEEMAIL="):
+                    email = line.split("=", 1)[1].strip().strip("'\"")
+                elif line.startswith("ACME_MCA="):
+                    ca_raw = line.split("=", 1)[1].strip().strip("'\"")
+                elif line.startswith("ACME_CERTKEYSIZE="):
+                    raw_val = line.split("=", 1)[1].strip().strip("'\"")
+                    key_length = int(raw_val) if raw_val.isdigit() else None
+            if email and ca_raw:
+                return {
+                    "registered": True,
+                    "email": email,
+                    "ca": _resolve_ca_name(ca_raw),
+                    "key_length": key_length,
+                }
 
+    # 2. Declarative config (saved by register_account / set_email handlers)
+    #    Modern acme.sh (v3.x) stores account data in per-CA JSON files
+    #    (ca/<server>/account.json) — we can't reliably parse those without
+    #    walking the directory, so fall back to the declarative config
+    #    which the handlers keep in sync.
+    #    Derive project root from acme_home (acme_home is at <root>/data/acme).
     try:
-        text = account_path.read_text()
-    except OSError:
-        return default
+        project_root = acme_home.parent.parent  # data/acme → data → project root
+        acme_cfg = project_root / "config" / "acme" / "config.json"
+        data = load_json(acme_cfg)
+        email = (data.get("email") or "").strip()
+        ca_raw = (data.get("ca") or "").strip()
+        if email and ca_raw:
+            return {
+                "registered": True,
+                "email": email,
+                "ca": _resolve_ca_name(ca_raw),
+                "key_length": None,
+            }
+    except (OSError, ValueError):
+        pass
 
-    email = ""
-    ca_raw = ""
-    key_length = None
-
-    for line in text.splitlines():
-        if line.startswith("ACME_LEEMAIL="):
-            email = line.split("=", 1)[1].strip().strip("'\"")
-        elif line.startswith("ACME_MCA="):
-            ca_raw = line.split("=", 1)[1].strip().strip("'\"")
-        elif line.startswith("ACME_CERTKEYSIZE="):
-            raw_val = line.split("=", 1)[1].strip().strip("'\"")
-            key_length = int(raw_val) if raw_val.isdigit() else None
-
-    if not email or not ca_raw:
-        return default
-
-    ca = _resolve_ca_name(ca_raw)
-
-    return {
-        "registered": True,
-        "email": email,
-        "ca": ca,
-        "key_length": key_length,
-    }
+    return default
 
 
 def _get_acme_email() -> str:
@@ -797,7 +819,8 @@ def _collect_acme() -> dict[str, Any]:
             if not main:
                 continue
             san_domains = [
-                d.strip() for d in entry.get("san_domains", "").split(",") if d.strip()
+                d.strip() for d in entry.get("san_domains", "").split(",")
+                if d.strip() and d.strip().lower() != "no"
             ]
             cert_dir = acme_home / main
             days = _days_until(entry.get("renew", ""))