Pass --days to build-client-full when a lifetime is set

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

openvpncertupdate.py

@@ -352,12 +352,16 @@ def revoke_issued(
 
 def build_client_full(
     easyrsa_dir: str, pki_dir: str, cn: str,
-    key_passphrase: str, ca_passphrase: str, email: str = "",
+    key_passphrase: str, ca_passphrase: str, email: str = "", days: str = "",
 ) -> None:
     extra_env = {"EASYRSA_REQ_EMAIL": email} if email else None
     _run_easyrsa(
         _base_cmd(easyrsa_dir, pki_dir, ca_passphrase)
-        + [f"--passout=pass:{key_passphrase}", "build-client-full", cn],
+        + [f"--passout=pass:{key_passphrase}"]
+        # Global option, so it must precede the verb. Deliberately not in
+        # _base_cmd(): gen-crl reads --days as CRL validity instead.
+        + ([f"--days={days}"] if days else [])
+        + ["build-client-full", cn],
         cwd=easyrsa_dir,
         extra_env=extra_env,
     )