mx:watch_certs(
ssl_cfg) ->ok
Watch TLS certificates and publish their expiry as gauges
Takes the http server ssl config section (default identity plus
optional hosts map). Reads each certificate, publishes gauge
tls_cert_not_after{host} (the default identity under host
"default") and re-checks daily, since certs rotate under ACME. Call
from inside the LEV loop after start().