fix: strip private_key from WireGuard PATCH endpoint and add acme-challenge template

system/nginx/acme-challenge.conf

@@ -0,0 +1,17 @@
+# Auto-generated by Vacuum Wall — do not edit manually
+# Serve ACME HTTP-01 challenges on port 80 for any domain not yet
+# configured with a dedicated server block (catch-all).
+
+server {
+    listen 80 default_server;
+    listen [::]:80 default_server;
+    server_name _;
+
+    location /.well-known/acme-challenge/ {
+        root {{ acme_webroot }};
+    }
+
+    location / {
+        return 444;
+    }
+}