fix(ssl): validate le-mail before letsencrypt registration

[mrrobot47]

Problem

The Let's Encrypt account email (le-mail) was resolved with a ?? fallback that only guards null/unset — an empty string passed straight through to ACME register()/request(), producing a generic, confusing ACME failure. This affected init_le, ssl_verify, and ssl_renew.

Fix

Add a shared get_validated_le_mail() helper: resolve from config (or prompt interactively), validate non-empty + filter_var( …, FILTER_VALIDATE_EMAIL ), and hard-error with a clear message (Set it with \ee config set le-mail `.`) when it can't be resolved (e.g. non-interactive cron with no le-mail set). All three sites route through it.

In the renewal path the email is resolved after the 'le'/'inherit' site-type guard in renew_ssl_cert(), so a non-LE single-site ssl-renew still gets the accurate "Only Letsencrypt certificate renewal is supported." error rather than an email error.

Testing

Manual: with le-mail unset/garbage, a non-interactive LE issuance/renew now exits cleanly with the "valid email required" message instead of an opaque ACME error; a valid le-mail proceeds as before; a non-LE ssl-renew still reports the site-type error.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.