feat: 管理后台一键从 Caddy 获取证书 + TLS 证书热加载

- 域名编辑页新增“从 Caddy 获取证书”按钮：一键把本机 Caddy 已签发的
  证书与私钥导入该域名的 TLS 目录并自动启用 TLS，支持通配符证书
  （如 *.example.com 可匹配 mail.example.com），成功/失败均回显横幅
- 新增 internal/caddycert：搜索 Caddy 证书存储（同步镜像目录优先、
  caddy.data_dir 与常见位置兜底），校验密钥对/有效期/SAN，并给出
  可操作的中文错误提示（未找到/证书无效/权限不足）
- install.sh 新增 setup-caddy-cert：安装 root 权限的 systemd
  path+timer 同步任务（mailgo-caddy-sync），把 Caddy 证书树镜像到
  /srv/mail_go/tls/caddy（证书续期后自动更新、每日兜底），另授予
  ACL 作为直接读取兜底；install 时自动检测并配置
- 新增 [caddy] data_dir 配置节，支持自定义 Caddy 数据目录
- 新增 internal/tlsutil：TLS 证书热加载器，每次握手按需重载证书
  文件（mtime 检测），重载失败继续使用旧证书兜底并节流重试；
  应用于 SMTPS 465/IMAPS 993/POP3S 995 与 STARTTLS，导入或上传
  新证书后无需重启服务即生效
- 证书来源动态切换：协议显式配置优先，否则取首个启用 TLS 且有证书
  的域名（10 秒缓存），新域名一键导入证书后自动切换
- 更新 README 与界面文案（去掉“重启服务生效”提示）

internal/web/server.go

@@ -38,14 +38,15 @@ func formatBytes(b int64) string {
 
 // WebServer wraps the Gin engine and its dependencies.
 type WebServer struct {
-	engine     *gin.Engine
-	stores     *store.Stores
-	storage    *storage.AttachmentStorage
-	cfg        config.WebConfig
-	storageCfg config.StorageConfig
-	authCfg    config.AuthConfig
-	banCfg     config.BanConfig
-	outbound   *outbound.Manager
+	engine       *gin.Engine
+	stores       *store.Stores
+	storage      *storage.AttachmentStorage
+	cfg          config.WebConfig
+	storageCfg   config.StorageConfig
+	authCfg      config.AuthConfig
+	banCfg       config.BanConfig
+	caddyDataDir string
+	outbound     *outbound.Manager
 }
 
 // templateFuncs returns custom template functions for rendering.
@@ -84,7 +85,7 @@ func templateFuncs() template.FuncMap {
 
 // NewWebServer creates a new WebServer, initializes the Gin engine,
 // configures sessions, middleware, and registers all routes.
-func NewWebServer(cfg config.WebConfig, stores *store.Stores, attStorage *storage.AttachmentStorage, storageCfg config.StorageConfig, authCfg config.AuthConfig, banCfg config.BanConfig, ob *outbound.Manager) *WebServer {
+func NewWebServer(cfg config.WebConfig, stores *store.Stores, attStorage *storage.AttachmentStorage, storageCfg config.StorageConfig, authCfg config.AuthConfig, banCfg config.BanConfig, caddyCfg config.CaddyConfig, ob *outbound.Manager) *WebServer {
 	gin.SetMode(gin.ReleaseMode)
 	engine := gin.New()
 	engine.Use(gin.Logger())
@@ -107,14 +108,15 @@ func NewWebServer(cfg config.WebConfig, stores *store.Stores, attStorage *storag
 	engine.SetHTMLTemplate(tmpl)
 
 	ws := &WebServer{
-		engine:     engine,
-		stores:     stores,
-		storage:    attStorage,
-		cfg:        cfg,
-		storageCfg: storageCfg,
-		authCfg:    authCfg,
-		banCfg:     banCfg,
-		outbound:   ob,
+		engine:       engine,
+		stores:       stores,
+		storage:      attStorage,
+		cfg:          cfg,
+		storageCfg:   storageCfg,
+		authCfg:      authCfg,
+		banCfg:       banCfg,
+		caddyDataDir: caddyCfg.DataDir,
+		outbound:     ob,
 	}
 
 	ws.registerRoutes()
@@ -125,7 +127,7 @@ func NewWebServer(cfg config.WebConfig, stores *store.Stores, attStorage *storag
 func (ws *WebServer) registerRoutes() {
 	authHandler := handlers.NewAuthHandler(ws.stores, ws.authCfg, ws.banCfg)
 	mailHandler := handlers.NewMailHandler(ws.stores, ws.storage, ws.outbound)
-	adminHandler := handlers.NewAdminHandler(ws.stores, ws.storage, filepath.Join(ws.storageCfg.BaseDir, "tls", "domains"), ws.outbound)
+	adminHandler := handlers.NewAdminHandler(ws.stores, ws.storage, filepath.Join(ws.storageCfg.BaseDir, "tls", "domains"), ws.caddyDataDir, ws.outbound)
 
 	// Apply BanMiddleware globally before public routes
 	ws.engine.Use(middleware.BanMiddleware(ws.stores))
@@ -175,6 +177,7 @@ func (ws *WebServer) registerRoutes() {
 		admin.GET("/domains/:id/edit", adminHandler.EditDomain)
 		admin.POST("/domains/:id", adminHandler.UpdateDomain)
 		admin.POST("/domains/:id/delete", adminHandler.DeleteDomain)
+		admin.POST("/domains/:id/fetch-caddy-cert", adminHandler.FetchCaddyCert)
 		admin.GET("/domains/:id/dns", adminHandler.DNSHint)
 		admin.GET("/users", adminHandler.ListUsers)
 		admin.GET("/users/new", adminHandler.NewUser)