Fix: Honor --days flag for short-lived certificates

[hselomein]

Summary

• Add logic to respect user's --days setting for short-lived certificates
• Add parameter validation (1-398 days range)
• Add safety checks to prevent renewal after expiration
• Add clear user feedback messages
• Maintain backward compatibility
• Prepare for upcoming industry certificate lifespan reductions

Fixes issue where --days flag was ignored for certificates with short validity periods, causing unexpected renewal behavior.

Problem

The --days flag in acme.sh is currently ignored for short-lived certificates (typically 5-50 days validity), causing inconsistent behavior:

• Normal certificates (90+ days): --days 60 works as expected
• Short-lived certificates (5-50 days): --days value is completely ignored, renewal defaults to 1 day before expiration

Root Cause

The renewal calculation logic has separate code paths where short-lived certificates (when _notAfter is set) ignore Le_RenewalDays and use hardcoded fallback logic instead of respecting user preferences.

Solution

Enhanced renewal logic (lines ~5388-5427):

• Modified _notAfter code path to check user's --days setting first
• Added safety validation to prevent renewal after certificate expiration
• Maintained fallback logic for invalid user settings

Parameter validation (lines ~5351-5364):

• Early validation for --days parameter (1-398 days range)
• Clear error messages for invalid values
• Aligned with current industry standard (398 days max)

Testing

✅ Test Case 1: --days 7 with 20-day cert → Renews exactly 7 days after issuance
✅ Test Case 2: --days 25 with 20-day cert → Warning + fallback to safe default
✅ Test Case 3: Normal certificates maintain existing behavior

Backward Compatibility

• No breaking changes to existing behavior
• Normal certificates unchanged
• Short-lived certificates without --days continue using current logic
• No changes to configuration format or cron behavior

Future-Proofing

Prepares for industry transitions to shorter certificate lifespans (398→200→100→47 days by 2029) while respecting user intent.