[Coysh]

What changed

The warning window is now a setting. Until now a certificate became a finding 30 days before it expired, always. A Let's Encrypt certificate renews itself around 30 days out, so it was flagged on every renewal cycle until the renewal landed, and the finding taught people to acknowledge it unread.

• Settings → General has a "Warn about expiring certificates" form (owners only, recent authentication required): a whole number of days, 1 to 90. Empty means "follow the installation default" and is stored as null, so an organisation that never chose keeps following it.
• Default comes from manager.findings.certificate_warn_days, set by MANAGER_CERTIFICATE_WARN_DAYS. Read with an is_numeric guard and clamped to 1-90, so a blank line in .env means 30 rather than zero.
• Urgent (high) is inside 7 days or the whole window, whichever is smaller.
• The rule, manager:certificates:check output and the Security tab's Expires row all ask Organisation::certificateWarnDays(), so they cannot disagree.
• Saving writes an organisation.certificate_warn_days.updated audit event with the before and after values. The hourly sweep applies a new window to every site.
• One migration: nullable organisations.certificate_warn_days (unsigned smallint). Reversible.

An acknowledgement belongs to one certificate. A certificate short-lived enough to stay inside the window never resolved, so each new one inherited the previous one's acknowledgement. There is a new optional ResetsAcknowledgement interface; CertificateExpiring implements it by comparing expires_at. When the finding stays outstanding but the expiry has moved, the acknowledgement is cleared and a finding.reopened audit event is written (before: the old reason; after: state, title and a plain-language reason). No notification is sent, since the finding never closed. No other rule is affected.

Needs no new contract and no hosting-layer binding: it is an organisation column plus a config value, so EditionSeamTest and NoCloudCodeTest are untouched and green.

Docs: docs/env.md, docs/monitoring.md, .env.example, CHANGELOG 1.9.0, and the version examples in getting-started, upgrade and rollback.

Verification

• Invariants suite: 643 passed
• Full suite: 1507 passed
• Pint, PHPStan: clean
• npm run build produces no change to public/build
• Seeded site with 20 days left and a 14-day window: sweep opens no finding; with the default window it opens one; back to 14 it resolves.