Harden ACME storage and expand security coverage

[matveynator]

Summary

• reject unsafe ACME domains before they can escape the certificate cache directory
• add meaningful fail-closed tests for ACME, account authentication, and cross-compilation orchestration
• cover SQL trigger failures, replay/expiry boundaries, malformed protocol responses, and missing build infrastructure

Validation

• accountauth: 90.3% statement coverage
• channelacme: 85.4% statement coverage
• crosscompile: 83.7% statement coverage
• targeted sitebrush security tests pass
• full pkg/scripts run is blocked by an existing database test that binds IPv6 localhost, which this sandbox forbids

The remaining two requested package thresholds are not honestly above 90% yet; the uncovered code is primarily OS/standard-library failure paths and platform-specific Docker/macOS orchestration.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!