Track what happens to every certificate, and show it on the Certs tab

NPM knows what a certificate is today and nothing about what it was, so ten of them could fail
renewal for months — 1001 certbot runs, zero successes — without anything on any page saying so.
Counts start at zero and are only ever observed; only first_seen is seeded, from NPM's own date.

Deployment/master.conf.template

@@ -488,6 +488,11 @@
         "Arrs_Stack/sonarr_tvdb_removed.sh"                # remove series dropped from TVDB
         "Docker_Essentials/docker_update.sh"          # pull container image updates before restart
         "Docker_Essentials/docker_daily_restart.sh"   # daily container restarts — runs last
+        # Last, and after git_pull_execute.sh which must always run first. Daily rather than with
+        # the Sunday cert monitor: CERT_HISTORY_STRIKES counts passes, so a weekly cadence would
+        # make five strikes five weeks. One NPM list call; it is what gives the Certs tab its
+        # per-domain renewal and failure counts.
+        "Plugin/unraid/Tools/cert_history.sh"         # record cert renewals, failures and age per domain
     )
 
 # Pull latest images for DAILY_RESTART_CONTAINERS before the daily restart.
@@ -1469,6 +1474,13 @@
     CERT_CRIT_DAYS=7            # critical alert within this many days
     CERT_TIMEOUT=10             # seconds per domain before giving up
 
+# ── Certificate History ──
+# Tools/cert_history.sh records every certificate NPM holds — first seen, renewals, failures —
+# into DB_DIR/cert_history.json, which is what the Certs tab draws its per-domain cards from.
+# A domain found expired on this many consecutive passes stops being counted as working. It is
+# not deleted: the history of something that broke is the reason the file is kept.
+    CERT_HISTORY_STRIKES=5      # expired passes before a domain is retired from the active list
+
 # ━━━ Backup Verify ━━━
 # Verifies rsync mirror health by comparing random file checksums between servers.
 # Catches silent corruption or incomplete syncs that rsync itself wouldn't detect.