Refactor ACME module and add cert issuance conflict handling

- Move acme.sh utilities (_run_acme, _find_acme, etc.) from lib/state to lib/acme
- Rewrite _parse_list_output to support pipe, tab, and column-separated formats
- Add ConflictError (409) to block issuing when cert already exists
- Move _find_issuance helper to detect in-progress issuance per domain
- Update issue_cert to check existing certs and return issuance status
- Fix start_polling to accept event loop explicitly
- Add sudoers entry for chown on vacuum-wall.conf
- Extend systemd ReadWritePaths for /run/nginx.pid and /var/log/nginx
- Update frontend to handle 'existing' issuance status

daemon/client.py

@@ -35,6 +35,12 @@ class BadRequest(Exception):
     pass
 
 
+class Conflict(Exception):
+    """Raised when the daemon returns HTTP 409."""
+
+    pass
+
+
 _DEFAULT_SOCKET = None
 
 
@@ -175,6 +181,8 @@ def request(
                 raise NotFound(data.get("error", str(exc))) from exc
             if resp.status_code == 400:
                 raise BadRequest(data.get("error", str(exc))) from exc
+            if resp.status_code == 409:
+                raise Conflict(data.get("error", str(exc))) from exc
             raise RuntimeError(data.get("error", str(exc))) from exc
     if not data.get("ok"):
         raise RuntimeError(data.get("error", "Unknown error"))