Bug Fix
1- Fixed an issue where an uploaded mail certificate could show as not installed. Mail certificate status is now read directly from the certificate file on disk, the same way the panel certificate status already works, instead of first initializing the Let's Encrypt (ACME) client (which could fail on network or account issues). Let's Encrypt issuance and renewal flows are unchanged.
Security Fix
1- Fixed mail certificate uploads being silently accepted even when broken. Uploads are now properly validated before anything touches disk: the certificate must parse and the private key must actually match it. A full chain pasted together with the certificate (leaf first) is still accepted; a mismatched or unusable pair is now rejected with a clear reason instead of failing silently.