fix(acme): restore no_log and switch to command+environment for credential safety

Re-adds no_log: true removed in 5e4e17e and switches the issue task from
ansible.builtin.shell with inline VAR=value to ansible.builtin.command with
an environment: dict. This prevents credentials appearing in Ansible failure
output and avoids the inline env var being clobbered when acme.sh sources
account.conf internally before the dns_namecom plugin runs.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

infrastructure/roles/acme/tasks/main.yml

@@ -59,20 +59,22 @@
   no_log: true
 
 - name: Issue certs via DNS-01 (name.com) — skip if already issued
-  ansible.builtin.shell: |
-    NAMECOM_Username="{{ acme_namecom_username }}" \
-    NAMECOM_Token="{{ acme_namecom_token }}" \
-    {{ acme_install_dir }}/acme.sh --issue \
-      --dns dns_namecom \
-      -d {{ item.domain }} \
-      --home {{ acme_install_dir }} \
-      --server letsencrypt
+  ansible.builtin.command: >-
+    {{ acme_install_dir }}/acme.sh --issue
+    --dns dns_namecom
+    -d {{ item.domain }}
+    --home {{ acme_install_dir }}
+    --server letsencrypt
+  environment:
+    NAMECOM_Username: "{{ acme_namecom_username }}"
+    NAMECOM_Token: "{{ acme_namecom_token }}"
   loop: "{{ acme_certs }}"
   register: acme_issue
   changed_when: "'Cert success' in acme_issue.stdout"
   # rc=2 means cert already exists and is not due for renewal — treat as ok
   failed_when: acme_issue.rc not in [0, 2]
   when: item.domain not in acme_list.stdout
+  no_log: true
 
 - name: Install cert files to target paths
   ansible.builtin.command: >-