fix(ssl): deploy nginx-proxy certs atomically with checked copies

[mrrobot47]

Problem

moveCertsToNginxProxy() deployed the freshly-issued cert with three sequential bare copy() calls (key, crt, chain) into services/nginx-proxy/certs/, ignoring every return value and with no temp-file + rename. A failure between copies (disk full, permissions, crash) left nginx-proxy pointing at a mismatched key/cert pair. This runs on both first issuance and renewal (the unattended cron path).

Fix

Copy each source to a temp file in the destination directory (checking copy()), then rename() each into place (checking rename()). rename() is atomic on the same filesystem, so a failed copy can no longer leave a half-written live key/cert. On any failure the temp files are cleaned up and an exception is thrown, rather than silently leaving a partial deploy.

Existing deployed files keep their mode on renewal (the temp file takes the live file's permissions before the rename), so a hardened chmod 600 key stays 0600.

Notes

• The three renames are each atomic per-file but not collectively atomic; the code does not roll back an already-renamed file (a same-filesystem rename failing after a prior success is near-impossible). The comment states this precisely.
• The method stays void and throws on failure: executeRenewal() already wraps the call in try/catch (surfaces as a renewal warning); on first issuance the exception propagates as a loud failure — preferable to the previous silent broken-cert outcome.
• Known, pre-existing: if the deploy fails on renewal, acme-conf already holds the new cert, so the next scheduled ssl-renew says "renewal is not necessary" and doesn't redeploy; only ssl-renew --force recovers. Until fix(ssl): include ACME error message in operator-facing warnings #486 lands, the renewal warning still reads "Challenge Authorization failed…"; the real reason is in ee.log.

Testing

Manual: issue/renew a cert and confirm .key/.crt/.chain.pem deploy together with no .tmp leftovers. To force a failure, make the certs dir immutable (chattr +i "$(readlink -f /opt/easyengine/services/nginx-proxy/certs)"; plain permissions don't stop root), run ee site ssl-renew <site> --force, and confirm it fails with Failed to copy certificate file … .tmp in ee.log, no "Certificate renewed successfully!", the live key/cert unchanged and no .tmp files; then chattr -i.

Tested on Ubuntu 26.04 with EasyEngine 4.12.0 with real Let's Encrypt certificates (first issuance, and a forced renewal with the certs dir immutable).

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.