Stable v2.9.51

• fix(mail): autoconfig registry lookup used the wrong cert name → 404, no idempotency
• fix(mail): issue autoconfig certs for mail domains on external DNS too
• fix(mail): autoconfig vhost must proxy the agent over https, not http
• fix(mail): default mail-autoconfig ON so QR-code setup can actually work
• fix(nginx): one missing cert must not block every other vhost restore
• fix(nginx): stop disabling MTA-STS, autoconfig and groupware vhosts, restore them
• fix(security-advisor): os_eol no longer vanishes, server_banner reads nginx -T
• fix(security-advisor): three more checks that answered from a proxy
• fix(security-advisor): report the SSH settings sshd applies, not a guess
• fix(security-advisor): add PHP 8.5 to the EOL table and name its source
• fix(security-advisor): two checks that reported safe without having checked