[client, management] Recover from stuck proof collections and keep re-tracked accounts on the challenge refresher (#7890)

Co-authored-by: Viktor Liu <viktor@netbird.io>

management/server/account.go

@@ -258,7 +258,6 @@ func BuildManager(
 	}
 
 	am.certChallenges = newCertChallengeRefresher(am.refreshCertificateChallenges)
-	am.certChallenges.Start(ctx)
 
 	am.networkMapController.StartWarmup(ctx)
 
@@ -301,6 +300,10 @@ func BuildManager(
 		am.onPeersInvalidated(ctx, accountID, peerIDs)
 	})
 
+	// Started last: a manager that fails to build is never returned, so nothing would
+	// stop its refresher.
+	am.certChallenges.Start(ctx)
+
 	return am, nil
 }
 

management/server/certificate_challenge.go

@@ -24,8 +24,8 @@ const (
 )
 
 // certChallengePeriod is how often an account whose policies carry a certificate
-// posture check is pushed a fresh challenge. A nonce is accepted for its own window and
-// the one before it, so one issued at the very end of a window lives only one window. A
+// posture check is pushed a fresh challenge. A nonce stays valid through the window
+// after its own, so one issued at the very end of a window lives only one window. A
 // third of that leaves a missed run well clear of the edge, where a half would put it
 // exactly on it.
 func certChallengePeriod() time.Duration {