xmpp_cert_sync: push asxp.io and xmpp.asxp.io as separate files

Traefik never requests a certificate for a name it already holds one
for, so the XMPP certificate came out without asxp.io, the XMPP domain
itself. ejabberd picks the matching certificate file per domain, so push
two: the site's asxp.io certificate and xmpp.asxp.io + conference.
The receiver takes the name from the SSH command (asxp.io or a
subdomain), checks the certificate matches it, and retires the
hand-made server.pem once both files are in place.

A second probe on 5223 sends SNI asxp.io, as clients do, and the
outdated-certificate alert compares each served certificate with its
source in acme.json.

Assisted-by: Claude:opus-5-5

ansible/roles/traefik/templates/dynamic.yml.j2

@@ -24,9 +24,8 @@ http:
   routers:
     # Exists only to obtain the XMPP certificate (ejabberd on services);
     # role xmpp_cert_sync pushes it there on every renewal. No traffic
-    # reaches it: these names point at services. The rule must not match
-    # asxp.io, or its higher priority would take the site over; the
-    # certificate still covers it through tls.domains.
+    # reaches it: these names point at services. asxp.io is pushed from
+    # the site's own certificate.
     xmpp-cert:
       rule: "Host(`{{ xmpp_cert_main }}`)"
       entryPoints: [websecure]