Fix ssl-certs-cron: replace unmaintained simp_le with certbot

[pansapiens]

Summary

• ssl-certs-cron's renewal script (docker/ssl-certs/update-ssl-cert.sh) uses simp_le, an unmaintained ACME client. Its bundled acme library crashes on import against current cryptography/pyOpenSSL (AttributeError: module 'OpenSSL.crypto' has no attribute 'X509Extension'), so renewal has been silently failing.
• Because the self-signed fallback in the script only kicks in when no cert files exist at all, the container never re-generates anything on failure — it just leaves the expired cert in place forever, which is what caused https://laxy.io's cert to actually expire in production.
• Replaces simp_le with certbot, pinned alongside compatible cryptography/pyopenssl versions, run in webroot mode against the same nginx-shared ACME challenge path already mounted into the container. Certbot's issued files are copied into /certs/ under the same filenames (cert.pem, chain.pem, fullchain.pem, key.pem) nginx and the rest of the compose stack already expect, so no other service config needs to change.
• This mirrors a one-off certbot run I used to manually reissue the cert on the production host as an immediate fix; this PR fixes it properly in the image so automatic renewal works going forward.

Test plan

• docker build the updated docker/ssl-certs image locally — builds cleanly, certbot --version runs without the previous X509Extension crash
• Verified certonly/webroot flags used in the script (--cert-name, --keep-until-expiring, --register-unsafely-without-email) are valid for the installed certbot version
• bash -n syntax check on the updated update-ssl-cert.sh
• Deploy to prod and confirm the next scheduled renewal succeeds (cert is currently valid until 2026-11-24 after a manual fix, so there's no urgency, but this should be verified before that date)