fix(acme): use shell inline env vars for issue; bypass sudo env_reset

Ansible command module + become does not reliably pass environment:
vars through sudo env_reset. Use ansible.builtin.shell with POSIX
inline assignment (VAR=val cmd) so credentials are set inside the
sudo-spawned shell subprocess, never touching the sudo env barrier.
account.conf writing retained for cron renewal.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

infrastructure/roles/acme/tasks/main.yml

@@ -59,18 +59,21 @@
   no_log: true
 
 - name: Issue certs via DNS-01 (name.com) — skip if already issued
-  ansible.builtin.command: >-
+  ansible.builtin.shell: |
-    {{ acme_install_dir }}/acme.sh --issue
+    NAMECOM_Username="{{ acme_namecom_username }}" \
-    --dns dns_namecom
+    NAMECOM_Token="{{ acme_namecom_token }}" \
-    -d {{ item.domain }}
+    {{ acme_install_dir }}/acme.sh --issue \
-    --home {{ acme_install_dir }}
+      --dns dns_namecom \
-    --server letsencrypt
+      -d {{ item.domain }} \
+      --home {{ acme_install_dir }} \
+      --server letsencrypt
   loop: "{{ acme_certs }}"
   register: acme_issue
   changed_when: "'Cert success' in acme_issue.stdout"
   # rc=2 means cert already exists and is not due for renewal — treat as ok
   failed_when: acme_issue.rc not in [0, 2]
   when: item.domain not in acme_list.stdout
+  no_log: true
 
 - name: Install cert files to target paths
   ansible.builtin.command: >-