Start background ACME provisioning and renewal.
Runs initial check after a short delay (to let proxy start), then every 24h.
After provisioning/renewal, hot-reloads the proxy’s TLS config automatically.
If provisioning with subdomains fails, retries with bare domain only.