fix(acme): replace fragile key-file regex selector with rejectattr

selectattr with 'match' regex was returning empty sequence on this Ansible
version. Since each install entry has exactly two items (fullchain.cer +
key), rejectattr the fullchain to get the key — no regex needed.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

infrastructure/roles/acme/tasks/main.yml

@@ -94,7 +94,7 @@
     -d {{ item.domain }}
     --home {{ acme_install_dir }}
     --fullchain-file {{ (item.install | selectattr('src', 'equalto', 'fullchain.cer') | first).dest }}
-    --key-file {{ (item.install | selectattr('src', 'match', '.*\\.key$') | first).dest }}
+    --key-file {{ (item.install | rejectattr('src', 'equalto', 'fullchain.cer') | first).dest }}
   loop: "{{ acme_certs }}"
   notify: reload prole ssl consumers