xmpp_cert_sync: renew the XMPP certificate through Traefik

The ejabberd certificate (asxp.io, conference., xmpp.) was issued by
hand and expires 2027-01-28 with nothing renewing it. Traefik now
obtains it alongside the sites' certificates, through a router that
only exists to request it, and a systemd path unit on ops pushes it to
services whenever acme.json changes, with a daily run as fallback.

The push uses its own SSH key, accepted from ops' VPC address only and
forced to xmpp-cert-install, which checks the certificate is valid for
another day and matches its key before replacing server.pem and
reloading ejabberd.

Two alerts: the sync hasn't succeeded for two days, or ejabberd serves
an older certificate than Traefik holds for six hours. The existing
expiry alert already covers port 5223.

Assisted-by: Claude:opus-5-5

ansible/roles/traefik/templates/dynamic.yml.j2

@@ -20,3 +20,20 @@ http:
         average: 100
         burst: 50
         period: 1s
+
+  routers:
+    # Exists only to obtain the XMPP certificate (ejabberd on services);
+    # role xmpp_cert_sync pushes it there on every renewal. No traffic
+    # reaches it: these names point at services. The rule must not match
+    # asxp.io, or its higher priority would take the site over; the
+    # certificate still covers it through tls.domains.
+    xmpp-cert:
+      rule: "Host(`{{ xmpp_cert_main }}`)"
+      entryPoints: [websecure]
+      priority: 1
+      service: noop@internal
+      tls:
+        certResolver: letsencrypt
+        domains:
+          - main: {{ xmpp_cert_main }}
+            sans: {{ xmpp_cert_sans | to_json }}