mx:watch_certs(
ssl_cfg) ->ok
Watch TLS certificates and publish their expiry as gauges
Takes the http server ssl config section (default identity plus the
optional certs array). Publishes gauge tls_cert_not_after{host}, one
series per certificate rather than per configured hostname, and
re-checks daily, since certs rotate under ACME.
The host label is the certificate's own name -- its explicitly
configured hostname if it has one, otherwise its common name or first
SAN -- so a wildcard certificate serving several names still reports
once. Call from inside the LEV loop after start().