fix: ECC cert support, ACME deploy hook path, NAT detection, and account config fallback

- Add find_cert_dir() to resolve both RSA and ECC (domain_ecc/) cert dirs
- Copy acme deploy hook to /deploy/ where acme.sh resolves it
- _parse_account_conf checks both legacy .account.conf and declarative config
- Skip public DNS check when all local IPs are private (NAT)
- Improve check message strings for validity and expiry status
- Support timezone-aware date formats in _days_until parsing
- Filter out "no" SAN domains in cert listing
- Bump frontend asset version cache keys
- Fix DOMContentLoaded race condition in app.js boot
- Fix spread operator in certs.js modal template

system/nginx/server_block.conf

@@ -26,8 +26,8 @@ server {
 {% if cert.type == "acme" %}
     # Certificate managed by acme.sh
 {% if cert.email %}    # ACME contact: {{ cert.email }}
-{% endif %}    ssl_certificate     {{ acme_home }}/{{ domain }}/fullchain.cer;
-    ssl_certificate_key {{ acme_home }}/{{ domain }}/{{ domain }}.key;
+{% endif %}    ssl_certificate     {{ acme_cert_dir }}/fullchain.cer;
+     ssl_certificate_key {{ acme_cert_dir }}/{{ domain }}.key;
 
 {% elif cert.type == "file" %}
     ssl_certificate     {{ cert.path }};
@@ -39,8 +39,8 @@ server {
 
 {% endif %}
 {% elif is_management %}
-    ssl_certificate     {{ acme_home }}/{{ domain }}/fullchain.cer;
-    ssl_certificate_key {{ acme_home }}/{{ domain }}/{{ domain }}.key;
+     ssl_certificate     {{ acme_cert_dir }}/fullchain.cer;
+     ssl_certificate_key {{ acme_cert_dir }}/{{ domain }}.key;
 
 {% endif %}
     # Shared SSL settings