Stable v2.8.40

• refactor(webmail): SOGo is the only engine — drop the roundcube setting/reconciler
• fix(webmail): keep the panel's real cert on catch-all re-render (no self-signed downgrade)