Add TLS client certificate expiry monitoring

[YiwenZhang12]

• Handshake monitoring: Every TLS client connection has its certificate inspected immediately after the handshake. We track the smallest “days until expiry” we’ve seen since startup/reset and surface it via INFO clients as client_cert_min_days_until_expiry (initially -1).

# Clients
...
client_cert_min_days_until_expiry:5

• Configurable warnings: Introduce tls-client-cert-expiry-warn-threshold so operators can enable proactive alerts. Example configuration:
  tls-client-cert-expiry-warn-threshold 10
  Example warning:
  TLS client certificate for id=147 addr=10.1.2.3:54128 fd=15 name=*redacted* expires in 4 days (threshold 10 days).

• 24‑hour deduplication: To avoid flooding logs, each certificate is fingerprinted (SHA‑256) and stored in client_cert_expiry_warned with a 24‑hour suppression window. The same certificate will trigger at most one warning per day.