Migrate declarative configs to config/ dir and remove hardcoded paths

Replace all hardcoded /home/wall/vacuum-wall paths in lib/ with Path(__file__).resolve()
auto-discovery. Move config files from data/ to config/<subsystem>/config.json.
ACME now uses ACME_HOME env var and data/acme/ for cert storage. Systemd units
and sudoers use {{ USER_NAME }}, {{ PROJECT_DIR }}, {{ ACME_HOME }} Jinja2
template variables for install-time substitution. Remove sys.path.insert boot
strap from test files.

tests/test_acme.py

@@ -1,4 +1,3 @@
-import sys
 import tempfile
 from datetime import datetime
 from pathlib import Path
@@ -6,31 +5,28 @@ from unittest.mock import MagicMock, patch
 
 import pytest
 
-sys.path.insert(0, "/home/wall/vacuum-wall")
-
 from lib import acme
 
 
 class TestFindAcme:
     @patch("lib.acme.shutil.which")
-    @patch("lib.acme.Path.home")
-    def test_finds_in_home(self, mock_home, mock_which):
-        mock_home.return_value = Path("/tmp/fakehome")
-        acme_path = mock_home.return_value / ".acme.sh" / "acme.sh"
-        acme_path.parent.mkdir(parents=True, exist_ok=True)
-        acme_path.write_text("#!/bin/sh\n")
-        acme_path.chmod(0o755)
-        try:
+    @patch("lib.acme._ACME_HOME")
+    def test_finds_in_acme_home(self, mock_acme_home, mock_which):
+        mock_acme_home = Path("/tmp/fake-acme-home")
+        mock_acme_home.mkdir(parents=True, exist_ok=True)
+        acme_bin = mock_acme_home / "acme.sh"
+        acme_bin.write_text("#!/bin/sh\n")
+        acme_bin.chmod(0o755)
+
+        with patch.object(acme, "_ACME_HOME", mock_acme_home):
             result = acme._find_acme()
             assert "acme.sh" in result
-        finally:
-            acme_path.unlink()
 
-    @patch("lib.acme.shutil.which")
-    @patch("lib.acme.Path.home")
-    def test_raises_when_not_found(self, mock_home, mock_which):
-        mock_home.return_value = Path("/tmp/nonexistent-acme-dir")
-        mock_which.return_value = None
+        acme_bin.unlink()
+
+    @patch("lib.acme._find_acme")
+    def test_raises_when_not_found(self, mock_find):
+        mock_find.side_effect = FileNotFoundError()
         with pytest.raises(FileNotFoundError):
             acme._find_acme()
 
@@ -112,32 +108,30 @@ class TestDaysUntil:
 
 class TestGetEmail:
     def test_returns_empty_when_no_account_conf(self):
-        with patch("lib.acme.Path.home") as mock_home:
-            mock_home.return_value = Path("/tmp/no-acme-email")
+        with patch.object(acme, "_ACME_HOME", Path("/tmp/no-acme-email")):
             result = acme.get_email()
             assert result == ""
 
     def test_parses_email_from_account_conf(self):
         tmpdir = tempfile.mkdtemp()
-        acme_dir = Path(tmpdir) / ".acme.sh"
-        acme_dir.mkdir(exist_ok=True)
+        acme_dir = Path(tmpdir) / "data" / "acme"
+        acme_dir.mkdir(parents=True, exist_ok=True)
         conf = acme_dir / "account.conf"
         conf.write_text("ACME_LEEMAIL='test@example.com'\n")
 
-        with patch("lib.acme.Path.home", return_value=Path(tmpdir)):
+        with patch.object(acme, "_ACME_HOME", acme_dir):
             result = acme.get_email()
             assert result == "test@example.com"
 
 
 class TestGetCertPaths:
-    @patch("lib.acme.Path.home")
-    def test_returns_paths(self, mock_home):
-        mock_home.return_value = Path("/home/user")
-        paths = acme.get_cert_paths("example.com")
-        assert paths["cert"].endswith("example.com/example.com.cert")
-        assert paths["key"].endswith("example.com/example.com.key")
-        assert paths["ca"].endswith("example.com/ca.cer")
-        assert paths["fullchain"].endswith("example.com/fullchain.cer")
+    def test_returns_paths(self, tmp_path):
+        with patch.object(acme, "_ACME_HOME", tmp_path / "data" / "acme"):
+            paths = acme.get_cert_paths("example.com")
+            assert paths["cert"].endswith("example.com/example.com.cert")
+            assert paths["key"].endswith("example.com/example.com.key")
+            assert paths["ca"].endswith("example.com/ca.cer")
+            assert paths["fullchain"].endswith("example.com/fullchain.cer")
 
 
 class TestDeployHook:
@@ -153,20 +147,22 @@ class TestDeployHook:
 
 
 class TestHasAutoRenew:
-    @patch("lib.acme.Path.home")
-    def test_true_when_conf_exists(self, mock_home):
-        tmpdir = tempfile.mkdtemp()
-        acme_dir = Path(tmpdir) / ".acme.sh"
-        acme_dir.mkdir()
+    def test_true_when_conf_exists(self, tmp_path):
+        acme_dir = tmp_path / "data" / "acme"
+        acme_dir.mkdir(parents=True)
         conf = acme_dir / "example.com.conf"
         conf.touch()
-        mock_home.return_value = Path(tmpdir)
-        result = acme._has_auto_renew("example.com")
-        assert result is True
+
+        with patch.object(acme, "_ACME_HOME", acme_dir):
+            result = acme._has_auto_renew("example.com")
+            assert result is True
+
         conf.unlink()
 
-    @patch("lib.acme.Path.home")
-    def test_false_when_conf_missing(self, mock_home):
-        mock_home.return_value = Path(tempfile.mkdtemp())
-        result = acme._has_auto_renew("nonexistent.com")
-        assert result is False
+    def test_false_when_conf_missing(self, tmp_path):
+        acme_dir = tmp_path / "data" / "acme"
+        acme_dir.mkdir(parents=True)
+
+        with patch.object(acme, "_ACME_HOME", acme_dir):
+            result = acme._has_auto_renew("nonexistent.com")
+            assert result is False