fix(ingress): re-obtain certificate when switching between staging and production

[kvinwang]

Problem

When switching CERTBOT_STAGING between true and false (from production to staging), the dstack-ingress container enters a crash loop and HTTPS becomes completely unavailable.

Root Cause

Certificate files and ACME account files are stored under different directory structures in /etc/letsencrypt/:

• Cert files are stored by domain name (same path regardless of staging/production):

  /etc/letsencrypt/live/example.com/fullchain.pem
  

• ACME account files are stored by ACME server (different path for staging vs production):

  production: /etc/letsencrypt/accounts/acme-v02.api.letsencrypt.org/directory/<hash>/regr.json
  staging:    /etc/letsencrypt/accounts/acme-staging-v02.api.letsencrypt.org/directory/<hash>/regr.json
  

When switching from production to staging (or vice versa), the cert-data Docker volume still has the old cert file, but the ACME account only exists under the previous server's directory. This triggers the following failure chain:

1. certificate_exists() returns True (cert file is per-domain, still exists)
2. Code takes the renew path instead of obtain (skips account registration)
3. certbot renew --staging exits 0 but does nothing useful (no matching renewal config for staging server)
4. Code prints "✓ Certificate renewal completed" (false positive — exit code 0 doesn't mean anything was renewed)
5. generate-evidences.sh looks for ACME account file under the staging path → not found → exits 1
6. entrypoint.sh has set -e → script exits → nginx never starts → container crash loops

Fix

1. Check ACME account existence before deciding renew vs obtain

Add acme_account_exists() that checks if an account file exists for the current staging/production mode. The auto action now requires both cert file AND matching ACME account to take the renew path. When the account is missing, it falls through to obtain_certificate() which registers a new ACME account.

2. Fix false success reporting in renew_certificate()

certbot renew exits 0 even when "No renewals were attempted". Previously the code treated all exit-0 as successful renewal. Now it checks stdout for "No renewals were attempted" before reporting success, and correctly returns (True, False) instead of (True, True).

3. Remove unreachable dead code

The "No renewals were attempted" check after the if/else block was dead code (unreachable after return statements). Removed.

Test plan

• Deploy with CERTBOT_STAGING=true on a fresh volume → should obtain cert via staging
• Deploy with production cert on volume, then switch to CERTBOT_STAGING=true → should detect missing staging account and re-obtain
• Deploy with existing staging cert + account → should take normal renew path

[wwwehr]

lgtm