xmpp_cert_sync: push asxp.io and xmpp.asxp.io as separate files

Traefik never requests a certificate for a name it already holds one
for, so the XMPP certificate came out without asxp.io, the XMPP domain
itself. ejabberd picks the matching certificate file per domain, so push
two: the site's asxp.io certificate and xmpp.asxp.io + conference.
The receiver takes the name from the SSH command (asxp.io or a
subdomain), checks the certificate matches it, and retires the
hand-made server.pem once both files are in place.

A second probe on 5223 sends SNI asxp.io, as clients do, and the
outdated-certificate alert compares each served certificate with its
source in acme.json.

Assisted-by: Claude:opus-5-5

ansible/roles/monitoring/templates/blackbox.yml.j2

@@ -19,6 +19,15 @@ modules:
     tcp:
       preferred_ip_protocol: ip4
       tls: true
+  # XMPP clients name the XMPP domain (asxp.io), not the SRV host, in SNI
+  tls_connect_asxpio:
+    prober: tcp
+    timeout: 10s
+    tcp:
+      preferred_ip_protocol: ip4
+      tls: true
+      tls_config:
+        server_name: asxp.io
   tcp_connect:
     prober: tcp
     timeout: 10s