fix(ssl): validate custom certificate and key before install

[mrrobot47]

Problem

validate_site_custom_ssl() only checked that the --ssl-key/--ssl-crt files exist; custom_site_ssl() then copied them into services/nginx-proxy/certs/ with no validation. A malformed PEM, or a certificate and key that don't match, silently breaks nginx-proxy on the next reload.

Fix

Add assert_valid_cert_key_pair() (called from validate_site_custom_ssl() before the paths are stored): parse the certificate (openssl_x509_parse), parse the key (openssl_pkey_get_private), and verify they match (openssl_x509_check_private_key). An unparseable certificate, an invalid key, or a key/cert mismatch are hard errors. An expired or near-expiry (< 30 days) certificate is a loud warning (not a block), so legitimate clone/restore flows that re-supply an existing certificate still proceed.

Testing

Manual: mismatched key/crt → error; malformed PEM → error; expired cert → warning (proceeds); valid matching pair → installs. The validation helper is pure and unit-testable.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.