Automatic Letsencrypt certificate refresh

[j-chmielewski]

Closes #2390.

• Adds utility thread job that periodically checks validity of Let's Encrypt certificate
• If cert is valid for < 14 days then refreshes the certificate
• If errors occurred during the refresh sends an email to all admins with error message and attached log file

[Copilot]

Pull request overview

This PR adds an automated Let's Encrypt certificate renewal/refresh mechanism for the Edge (proxy) certificate, including admin email notifications (with logs attached) on ACME failures, and refactors shared ACME helper code into a dedicated core module.

Changes:

• Add periodic (daily) LetsEncrypt certificate expiry checks in the utility thread and trigger ACME refresh when within a threshold.
• Introduce a new defguard_core::letsencrypt module that encapsulates ACME trigger, timeout handling, cert persistence, and notification logic.
• Add a new mail template + DB migration entries to notify admins when automatic certificate refresh fails (including logs attachment).

Reviewed changes

Copilot reviewed 12 out of 12 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
migrations/20260417073540_[2.0.0]_letsencrypt_cert_refresh.up.sql	Adds mail_context rows for the new failure notification template.
migrations/20260417073540_[2.0.0]_letsencrypt_cert_refresh.down.sql	Removes the inserted mail_context rows for rollback.
crates/defguard_mail/templates/letsencrypt-cert-refresh-failed.text	Adds plaintext template for refresh-failure notification.
crates/defguard_mail/templates/letsencrypt-cert-refresh-failed.mjml	Adds MJML template for refresh-failure notification.
crates/defguard_mail/src/templates.rs	Adds mail-sending function for refresh-failure notifications (with log attachment).
crates/defguard_mail/src/mail.rs	Adds new MailMessage variant and wires it to templates + subject.
crates/defguard_core/src/utility_thread.rs	Schedules daily LE expiry checks and triggers refresh.
crates/defguard_core/src/lib.rs	Exposes new letsencrypt module.
crates/defguard_core/src/letsencrypt.rs	Implements refresh logic, proxy ACME trigger, cert persistence, and admin notification (plus tests).
crates/defguard_core/src/handlers/component_setup.rs	Reuses the shared LE/ACME helpers from the new module for the SSE setup flow.
crates/defguard_common/src/db/models/settings.rs	Adds Settings::proxy_hostname() helper + new SettingsUrlError variants.
crates/defguard/src/main.rs	Updates utility thread startup to pass proxy_control_tx.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.