Fix angie ssl-listen pick, expose cert SAN domains

[sergeyfast]

Summary

Two related fixes against angie discovery & SSL reporting, surfaced by production logs showing angie: API returned error status status=400 and a UI listing only 2 domains for a host with many access logs.

• angie auto-discovery picks a usable listen port. When a server block has both listen 80; and listen 443 ssl;, findDirective used to overwrite the port with the last listen seen — ending up with http://127.0.0.1:443/status/, which makes angie return HTTP 400 («plain HTTP to HTTPS port»). Both the api collector and the ACME collector (which reuses the same URL) failed. Now non-ssl listen always wins; an ssl-only listen is still recorded (better than port 0) but logs a warning at startup so operators see the misconfig before scrape errors land.
• SSL collector exposes every domain a cert serves. Multi-host certs from angie ACME pack several subdomains into one .pem via SAN. The collector previously emitted only Subject.CommonName, so the UI showed the primary CN but missed every other SAN entry. New info-style metric topsrv_ssl_certificate_san_info{path,domain} enumerates every DNS name in CN ∪ SANs (dedup, CN first). topsrv_ssl_certificate_expiry_seconds stays one series per cert file — NotAfter isn't duplicated across N rows. Convention follows blackbox_exporter's probe_ssl_last_chain_info. Operators join by path to get «days until expiry per served domain».

Docs: README.md, docs/metrics.md, and docs/promql-recipes.md updated with the new metric and a join example.

Test plan

• make fmt lint — 0 issues
• GOEXPERIMENT=jsonv2 go test ./... — full suite green
• New unit tests:
  • TestDiscoverAngieEdgeCases/multiple_listen_—_non-ssl_wins_over_ssl
  • TestDiscoverAngieEdgeCases/ssl_listen_declared_first_—_non-ssl_still_wins
  • TestDiscoverAngieEdgeCases/ssl_flag_among_other_listen_params_(http2)
  • TestSSLCollectorSANInfo — 3-domain SAN (example.com placeholders), CN-in-DNSNames dedup
  • TestSSLCollectorNoCNorSAN — patological cert, san_info suppressed, expiry still visible
• Deploy to an affected host: verify angie: auto-detected API url=http://127.0.0.1:80/status/ (not 443), no more HTTP 400 from collectors, and SSL Certificates UI lists all SAN domains for every multi-host ACME cert