feat(tls): manage ACME domain and add desktop client settings

frontend/src/locales/en-US.json

@@ -728,6 +728,14 @@
   "protocolIcon": {
     "custom": "Custom Protocol"
   },
+  "tls": {
+    "title": "Domain & certificate",
+    "description": "OpsX VPN can serve ports 80/443 with automatic ACME HTTP-01 issuance and renewal; Nginx and Certbot are optional.",
+    "domain": "Configured domain", "activeDomain": "Active domain", "saveDomain": "Save domain", "restartRequired": "Domain saved; restart OpsX VPN to enable ports 80/443 and automatic issuance", "saveFailed": "Could not save domain", "dns": "DNS", "certificate": "Certificate", "valid": "Valid", "pending": "Pending first HTTPS handshake",
+    "notConfigured": "Disabled", "saved": "Domain configuration saved", "issuer": "Issuer", "expires": "Expires", "renewal": "Renewal", "automatic": "Automatic (autocert)",
+    "ports": "Listening ports (HTTP / HTTPS)", "setupHint": "Save the domain and restart the server, then allow public TCP 80/443. The first HTTPS request issues a certificate and caches it in data/acme. VPN_TLS_DOMAIN may also be used and overrides the saved setting. Preserve the data directory.",
+    "refresh": "Refresh status", "openHttps": "Open HTTPS health check", "loadFailed": "Could not load certificate status"
+  },
   "protocols": {
     "wireguard": {
       "name": "WireGuard",

frontend/src/locales/zh-CN.json

@@ -728,6 +728,14 @@
   "protocolIcon": {
     "custom": "自定义协议"
   },
+  "tls": {
+    "title": "域名与证书",
+    "description": "opsx-vpn 可直接监听 80/443，通过 ACME HTTP-01 自动签发和续签；无需 Nginx 或 Certbot。",
+    "domain": "配置域名", "activeDomain": "当前监听域名", "saveDomain": "保存域名", "restartRequired": "域名已保存，重启 opsx-vpn 后才会监听 80/443 并启用自动签发", "saveFailed": "保存域名失败", "dns": "DNS 解析", "certificate": "证书", "valid": "有效", "pending": "等待首次 HTTPS 请求签发",
+    "notConfigured": "未启用", "saved": "域名配置已保存", "issuer": "颁发者", "expires": "到期时间", "renewal": "续签", "automatic": "自动（autocert）",
+    "ports": "监听端口（HTTP / HTTPS）", "setupHint": "保存域名并重启服务，放行公网 TCP 80/443；证书将在该域名首次 HTTPS 访问时签发，缓存于 data/acme。也可用 VPN_TLS_DOMAIN 环境变量设置（优先于页面配置）。请保留数据目录。",
+    "refresh": "刷新状态", "openHttps": "打开 HTTPS 健康检查", "loadFailed": "读取证书状态失败"
+  },
   "protocols": {
     "wireguard": {
       "name": "WireGuard",