Fix install.sh gaps and add missing schema tables

- Add sshpass to base packages (required by ProxyManager remote SSH)
- Add PORT_WEBMAIL to Apache ports.conf listen loop (was missing port 8883)
- Add systemctl nginx/apache2 to www-data sudoers (local proxy mode needs these)
- Fix cron to use real script paths: bin/collect-stats.php + bin/notify-checks.php
- Seed proxy_mode=disabled and proxy_apache_port=80 defaults after schema import
- Add api_rate_limits table (rate limiting middleware requires it)
- Add proxy_hosts table (ProxyManager requires it for host CRUD)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

db/schema.sql

@@ -381,4 +381,25 @@ CREATE TABLE IF NOT EXISTS dkim_keys (
   CONSTRAINT fk_dkim_acct FOREIGN KEY (account_id) REFERENCES accounts(id) ON DELETE CASCADE
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 
+CREATE TABLE IF NOT EXISTS api_rate_limits (
+  ip           VARCHAR(45)  NOT NULL,
+  endpoint     VARCHAR(32)  NOT NULL,
+  hits         INT UNSIGNED NOT NULL DEFAULT 1,
+  window_start INT UNSIGNED NOT NULL DEFAULT 0,
+  PRIMARY KEY (ip, endpoint)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+CREATE TABLE IF NOT EXISTS proxy_hosts (
+  id            INT UNSIGNED AUTO_INCREMENT PRIMARY KEY,
+  account_id    INT UNSIGNED,
+  domain        VARCHAR(253) NOT NULL,
+  upstream      VARCHAR(255) NOT NULL,
+  ssl_enabled   TINYINT(1)   NOT NULL DEFAULT 0,
+  enabled       TINYINT(1)   NOT NULL DEFAULT 1,
+  custom_config TEXT,
+  created_at    DATETIME     NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  UNIQUE KEY uq_domain (domain),
+  CONSTRAINT fk_proxy_acct FOREIGN KEY (account_id) REFERENCES accounts(id) ON DELETE SET NULL
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
 SET foreign_key_checks = 1;