fix(acme): Refactor ACME challenge route lifecycle to prevent port 80 EADDRINUSE errors

docs/certificate-management.md

@@ -279,12 +279,31 @@ await proxy.updateRoutes([
 3. **Existing Certificates**: Certificates already provisioned are retained in the certificate store
 4. **New Route Certificates**: New routes with `certificate: 'auto'` will trigger certificate provisioning
 
+### ACME Challenge Route Lifecycle
+
+SmartProxy v19.2.3+ implements an improved challenge route lifecycle to prevent port conflicts:
+
+1. **Single Challenge Route**: The ACME challenge route on port 80 is added once during initialization, not per certificate
+2. **Persistent During Provisioning**: The challenge route remains active throughout the entire certificate provisioning process
+3. **Concurrency Protection**: Certificate provisioning is serialized to prevent race conditions
+4. **Automatic Cleanup**: The challenge route is automatically removed when the certificate manager stops
+
+### Troubleshooting Port 80 Conflicts
+
+If you encounter "EADDRINUSE" errors on port 80:
+
+1. **Check Existing Services**: Ensure no other service is using port 80
+2. **Verify Configuration**: Confirm your ACME configuration specifies the correct port
+3. **Monitor Logs**: Check for "Challenge route already active" messages
+4. **Restart Clean**: If issues persist, restart SmartProxy to reset state
+
 ### Route Update Best Practices
 
 1. **Batch Updates**: Update multiple routes in a single `updateRoutes()` call for efficiency
 2. **Monitor Certificate Status**: Check certificate status after route updates
 3. **Handle ACME Errors**: Implement error handling for certificate provisioning failures
 4. **Test Updates**: Test route updates in staging environment first
+5. **Check Port Availability**: Ensure port 80 is available before enabling ACME
 
 ## Best Practices