refactor(lib): fix acme.renew deploy call and hoist wireguard imports

- Add deploy(domain) to acme.renew() to register deploy hook after
  renewal, matching the pattern in issue()
- Hoist run and run_proc imports to module level in wireguard,
  removing 4 inline imports for consistency

tests/test_wireguard.py

@@ -1,5 +1,5 @@
 import json
-from pathlib import Path
+from copy import deepcopy
 from unittest.mock import MagicMock, patch
 
 import pytest
@@ -10,14 +10,14 @@ from lib import wireguard
 @pytest.fixture
 def temp_config(tmp_path):
     original = wireguard.CONFIG_PATH
-    wireguard.CONFIG_PATH = str(tmp_path / "config.json")
+    wireguard.CONFIG_PATH = tmp_path / "config.json"
     yield tmp_path
     wireguard.CONFIG_PATH = original
 
 
 class TestDefaultConfig:
     def test_returns_skeleton(self):
-        cfg = wireguard._default_config()
+        cfg = wireguard.DEFAULT_CONFIG
         assert cfg["interface"]["name"] == "wg0"
         assert cfg["interface"]["listen_port"] == 51820
         assert cfg["interface"]["private_key"] == ""
@@ -31,8 +31,7 @@ class TestGetConfig:
         assert cfg["peers"] == {}
 
     def test_loads_existing_config(self, temp_config):
-        path = Path(wireguard.CONFIG_PATH)
-        expected = {
+        wireguard.CONFIG_PATH.write_text(json.dumps({
             "interface": {
                 "name": "wg0",
                 "listen_port": 51820,
@@ -43,15 +42,14 @@ class TestGetConfig:
                 "post_down": None,
             },
             "peers": {},
-        }
-        path.write_text(json.dumps(expected))
+        }))
         cfg = wireguard.get_config()
         assert cfg["interface"]["private_key"] == "existing-key"
 
 
 class TestSaveConfig:
     def test_save_and_reload(self, temp_config):
-        cfg = wireguard._default_config()
+        cfg = deepcopy(wireguard.DEFAULT_CONFIG)
         cfg["interface"]["listen_port"] = 51821
         wireguard.save_config(cfg)
         loaded = wireguard.get_config()
@@ -59,7 +57,7 @@ class TestSaveConfig:
 
 
 class TestGenerateKeyPair:
-    @patch("lib.wireguard._run")
+    @patch("lib.wireguard.run_proc")
     def test_returns_keypair(self, mock_run):
         mock_run.side_effect = [
             MagicMock(returncode=0, stdout="private-key\n"),
@@ -68,6 +66,8 @@ class TestGenerateKeyPair:
         private, public = wireguard.generate_keypair()
         assert private == "private-key"
         assert public == "public-key"
+        assert mock_run.call_count == 2
+        assert mock_run.call_args_list[1].kwargs.get("input") == "private-key"
 
 
 class TestGetPeers:
@@ -97,7 +97,7 @@ class TestGetPeers:
                 }
             },
         }
-        Path(wireguard.CONFIG_PATH).write_text(json.dumps(cfg))
+        wireguard.CONFIG_PATH.write_text(json.dumps(cfg))
         peers = wireguard.get_peers()
         assert len(peers) == 1
         assert peers[0]["name"] == "client1"
@@ -180,14 +180,14 @@ class TestInitialize:
             },
             "peers": {},
         }
-        Path(wireguard.CONFIG_PATH).write_text(json.dumps(existing))
+        wireguard.CONFIG_PATH.write_text(json.dumps(existing))
         cfg = wireguard.initialize()
         assert cfg["interface"]["private_key"] == "original-private"
         mock_gen.assert_not_called()
 
 
 class TestStatus:
-    @patch("lib.wireguard._run")
+    @patch("lib.wireguard.run_proc")
     def test_returns_down_when_interface_down(self, mock_run, temp_config):
         mock_run.return_value = MagicMock(
             returncode=1, stdout="", stderr="interface not found"
@@ -195,7 +195,7 @@ class TestStatus:
         result = wireguard.status()
         assert result["up"] is False
 
-    @patch("lib.wireguard._run")
+    @patch("lib.wireguard.run_proc")
     def test_parses_interface_info(self, mock_run, temp_config):
         mock_run.return_value = MagicMock(
             returncode=0,
@@ -206,7 +206,7 @@ class TestStatus:
         assert result["interface"]["public_key"] == "ABCDEF"
         assert result["interface"]["listen_port"] == 51820
 
-    @patch("lib.wireguard._run")
+    @patch("lib.wireguard.run_proc")
     def test_parses_peer_info(self, mock_run, temp_config):
         mock_run.return_value = MagicMock(
             returncode=0,