Refactor ACME module and add cert issuance conflict handling

- Move acme.sh utilities (_run_acme, _find_acme, etc.) from lib/state to lib/acme
- Rewrite _parse_list_output to support pipe, tab, and column-separated formats
- Add ConflictError (409) to block issuing when cert already exists
- Move _find_issuance helper to detect in-progress issuance per domain
- Update issue_cert to check existing certs and return issuance status
- Fix start_polling to accept event loop explicitly
- Add sudoers entry for chown on vacuum-wall.conf
- Extend systemd ReadWritePaths for /run/nginx.pid and /var/log/nginx
- Update frontend to handle 'existing' issuance status

webui/api/certs.py

@@ -7,7 +7,7 @@ import logging
 
 from flask import Blueprint, request
 
-from daemon.client import BadRequest, NotFound, delete, get, post
+from daemon.client import BadRequest, Conflict, NotFound, delete, get, post
 from daemon.iface import (
     DELETE_ACME_ACCOUNT_DEACTIVATE,
     DELETE_ACME_REMOVE,
@@ -114,6 +114,8 @@ def issue_start():
     except BadRequest as exc:
         logger.info("Cert issue for '%s' rejected: %s", domain, exc)
         return _error(str(exc), 400)
+    except Conflict as exc:
+        return _error(str(exc), 409)
     except RuntimeError as exc:
         logger.error("Failed to start cert issue for '%s': %s", domain, exc)
         return _error(str(exc), 500)