nixos/security: add acme through dns challenge

few side refactors of this:
- no more `dns.domain`, it all must rely on `fqdn`, prevents
  inconsistencies.
- also added an specific host `tuxcord-acmetest` that uses the key zone
  for `nix.tuxcord.net` to test certificate pulling.

nixos/modules/default.nix

@@ -1,5 +1,6 @@
 {
   imports = [
+    ./acme.nix
     ./dns.nix
     ./fail2ban.nix
     ./gitea.nix