fix(scheduler): Cert-Renewal-Alerts pro Domain statt aggregierter Zählung (v1.1.143)

- certrenewer.Result.FailedDomains []string — jeder fehlgeschlagene Domain-Name
  wird erfasst (Issue/Parse/Write-Fehler)
- runRenewer: pro Domain eigener Alert + eigener Dedupe-Key statt einem
  shared "cert.renew_failed"-Key; Alert-Message nennt jetzt den Domain-Namen
  und gibt Hinweis auf ACME/DNS-Debugging

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

internal/services/certrenewer/certrenewer.go

@@ -62,12 +62,14 @@ func (s *Service) log() *slog.Logger {
 }
 
 // Result counts what one Run pass did so the scheduler can log /
-// surface it.
+// surface it. FailedDomains holds the domain names that failed so
+// the scheduler can fire per-domain alerts.
 type Result struct {
-	Checked  int
-	Renewed  int
-	Failed   int
-	Skipped  int
+	Checked       int
+	Renewed       int
+	Failed        int
+	Skipped       int
+	FailedDomains []string
 }
 
 // Run scans tls_certs for LE-issued rows that expire within the
@@ -95,6 +97,7 @@ func (s *Service) Run(ctx context.Context) (Result, error) {
 		certPEM, chainPEM, keyPEM, err := s.Issuer.Issue(row.Domain)
 		if err != nil {
 			res.Failed++
+			res.FailedDomains = append(res.FailedDomains, row.Domain)
 			s.log().Error("certrenewer: issue failed", "domain", row.Domain, "error", err)
 			_ = s.Repo.MarkError(ctx, row.Domain, err.Error())
 			continue
@@ -102,12 +105,14 @@ func (s *Service) Run(ctx context.Context) (Result, error) {
 		info, err := certstore.Parse(certPEM)
 		if err != nil {
 			res.Failed++
+			res.FailedDomains = append(res.FailedDomains, row.Domain)
 			_ = s.Repo.MarkError(ctx, row.Domain, "parse: "+err.Error())
 			continue
 		}
 		path, err := certstore.WriteCombined(s.CertDir, row.Domain, certPEM, chainPEM, keyPEM)
 		if err != nil {
 			res.Failed++
+			res.FailedDomains = append(res.FailedDomains, row.Domain)
 			_ = s.Repo.MarkError(ctx, row.Domain, "write: "+err.Error())
 			continue
 		}