nixos/security: add acme through dns challenge

few side refactors of this:
- no more `dns.domain`, it all must rely on `fqdn`, prevents
  inconsistencies.
- also added an specific host `tuxcord-acmetest` that uses the key zone
  for `nix.tuxcord.net` to test certificate pulling.

nixos/hosts/tuxcord-ca/default.nix

@@ -4,6 +4,11 @@
     ./storage.nix
   ];
 
+  acme = {
+    enable = true;
+    useSelfDns = true;
+  };
+
   dns.enable = true;
   networking.fqdn = "tuxcord.net";
   time.timeZone = "Canada/Eastern";