Add wildcard domain support with DNS-01 ACME challenge flow

Support wildcard domains (*.domain.tld) in HAProxy config generation
with exact-match ACLs prioritized over wildcard ACLs. Add DNS-01
challenge endpoints that coordinate with certbot via auth/cleanup
hook scripts for wildcard SSL certificate issuance.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

scripts/dns-challenge-cleanup-hook.sh

@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Certbot DNS-01 cleanup hook
+# Removes temporary challenge files after certbot finishes
+
+TOKEN_FILE="/tmp/dns-challenge-${CERTBOT_DOMAIN}.token"
+PROCEED_FILE="/tmp/dns-challenge-${CERTBOT_DOMAIN}.proceed"
+
+rm -f "${TOKEN_FILE}" "${PROCEED_FILE}"