fleet-manager: point acme DNS-01 propagation check at a public resolver

Split-horizon DNS made lego's propagation check query the container's internal
resolver, which doesn't serve the public _acme-challenge TXT record, so the
challenge timed out. Add ACME_RESOLVERS (comma-separated host:port, default
8.8.8.8:53) → one --dns.resolvers flag each. Documented in .env + DEPLOY.md.

serving/fleet-manager/acme/renew-loop.sh

@@ -32,6 +32,17 @@ LEGO=$(command -v lego 2>/dev/null || true)
 [ -z "$LEGO" ] && [ -x /lego ] && LEGO=/lego
 [ -z "$LEGO" ] && { echo "acme: FATAL lego binary not found (looked on PATH and /lego)"; exit 1; }
 
+# Force the DNS-01 propagation check against a PUBLIC resolver — the container's
+# internal/split-horizon DNS doesn't serve the public _acme-challenge record, so
+# lego's default (system resolver) never sees the TXT and times out. Accepts a
+# comma-separated list of host:port; each becomes a --dns.resolvers flag.
+RESOLVERS=""
+if [ -n "${ACME_RESOLVERS:-}" ]; then
+  OLDIFS=$IFS; IFS=','
+  for r in $ACME_RESOLVERS; do RESOLVERS="$RESOLVERS --dns.resolvers $r"; done
+  IFS=$OLDIFS
+fi
+
 while true; do
   # First pass issues; later passes renew when near expiry.
   if [ -f "/le/certificates/$DOMAIN.crt" ]; then
@@ -41,9 +52,9 @@ while true; do
   fi
   echo "acme: lego $* for $DOMAIN (Route 53 DNS-01)"
 
-  # shellcheck disable=SC2086  # $STAGING is intentionally two words when set
+  # shellcheck disable=SC2086  # $STAGING/$RESOLVERS intentionally word-split
   if "$LEGO" --accept-tos --email "$EMAIL" --dns route53 --domains "$DOMAIN" \
-          --path /le $STAGING "$@"; then
+          --path /le $RESOLVERS $STAGING "$@"; then
     install -m 644 "/le/certificates/$DOMAIN.crt" /out/fullchain.pem
     install -m 600 "/le/certificates/$DOMAIN.key" /out/privkey.pem
     chown "$UID_OUT:$UID_OUT" /out/fullchain.pem /out/privkey.pem 2>/dev/null \