Refactor ACME module and add cert issuance conflict handling

- Move acme.sh utilities (_run_acme, _find_acme, etc.) from lib/state to lib/acme
- Rewrite _parse_list_output to support pipe, tab, and column-separated formats
- Add ConflictError (409) to block issuing when cert already exists
- Move _find_issuance helper to detect in-progress issuance per domain
- Update issue_cert to check existing certs and return issuance status
- Fix start_polling to accept event loop explicitly
- Add sudoers entry for chown on vacuum-wall.conf
- Extend systemd ReadWritePaths for /run/nginx.pid and /var/log/nginx
- Update frontend to handle 'existing' issuance status

webui/static/pages/certs.js

@@ -236,7 +236,12 @@ function _bindIssueButtons(inner, modalIdx) {
         const body = { domain: _currentIssueState.domain };
         const issueResp = await apiFetch('/api/certs/issue/start', { method: 'POST', body });
         if (issueResp.ok) {
-            toast('Issuance started for ' + _currentIssueState.domain, 'success');
+            const status = issueResp.data?.status;
+            if (status === 'existing') {
+                toast('Issuance already in progress for ' + _currentIssueState.domain, 'warning');
+            } else {
+                toast('Issuance started for ' + _currentIssueState.domain, 'success');
+            }
             closeModal(modalIdx);
             const rid = issueResp.data?.request_id;
             if (rid) pollCertIssue(rid);