Fix cert deletion key and harden nginx SSL/redis handling

- host.remove() now deletes the cert under the host key instead of the
  Domain relation object, so certs are actually removed from redis
- targetinfo.lua returns the redis connection to the pool via
  set_keepalive instead of leaking one connection per request
- autossl.conf drops TLSv1/1.1 and 3DES, adds TLSv1.3

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

ops/nginx_conf/targetinfo.lua

@@ -37,6 +37,14 @@ function M.get(ngx, domain, targetInfo)
     local res, err = red:hgetall("proxy_Host_"..domain)
     res = red:array_to_hash(res)
 
+    -- Return the connection to the pool instead of closing it, so it can be
+    -- reused by later requests. Without this a new connection is opened per
+    -- request and never released, exhausting sockets under load.
+    local ok, err = red:set_keepalive(10000, 100)
+    if not ok then
+        ngx.log(ngx.ERR, "failed to set redis keepalive: ", err)
+    end
+
     if not res["ip"] then
         if connect("/var/run/proxy_lookup.socket") then 
             local socket = require("socket.unix")()