Allow server cert expiry to be set by the config wizard

[predictiple]

It's currently possible to generate a config with the default 1-year expiry and then immediately rotate the cert to a longer validity duration before deployment. But that's an extra step that most users won't think of at the time.

It would be much better if it was set by a step in the config wizard. That way we can still retain the default 1Y for most installations but advise users to set a longer validity if they are intending their installation to be a long-term deployment.

[scudette]

Fixed by #3945