fix(server): re-enable ACME certificate acquisition

[klobucar]

What this changes

Re-enables automated Let's Encrypt (ACME) certificate acquisition in the server,
restoring the intended TLS source priority: explicit cert/key files → ACME →
self-signed fallback. Also makes the Let's Encrypt production directory the
explicit default when no custom directory URL is configured, and unpins the
staging URL from fly.toml.

Why

The ACME path was hard-bypassed because rustls-acme 0.15.1 failed to parse
Let's Encrypt's challenge JSON (missing field token), leaving every deployment
on a self-signed cert. Upstream fixed the deserialization for token-less
challenge types in 0.15.2, and our lockfile already carries 0.15.4, so the
bypass is no longer needed (the Cargo.toml requirement is raised to match).

Two footguns fixed along the way:

• The standalone health-check listener now starts only in non-ACME m
  configure_acme already serves the HTTP-01 challenge route plus a
  check on acme_bind_port, so both would race to bind the same port.
• rustls-acme's builder defaults to the Let's Encrypt staging directory,
  whose certificates clients don't trust. An unset AURA_ACME_DIRECTORY_URL
  now explicitly selects production instead of silently issuing stag

How tested

• End-to-end against a live Pebble ACME server
  (test_acme_certificate_acquisition_with_pebble): certificate acquired in
  ~1.2s. Pebble runs from ghcr.io/letsencrypt/pebble (the Docker Hub image is
  no longer pullable).
• cargo test --workspace, cargo fmt --all -- --check, and
  cargo clippy --workspace --all-targets -- -D warnings all pass.
• rustls-acme 0.15.4 vetted via Socket (clean scores) and the #[serde(default)]
  token fix confirmed present in the published crate source.

Notes for the reviewer

• No wire-format or crypto changes — the QUIC ALPN (aura-dave) and
  are untouched; only the TLS certificate source changes.
• Deployments still inject the real AURA_ACME_DOMAIN / AURA_ACME_CONTACT
  via fly secrets set; the placeholders in fly.toml are unchange
• First deploy after this merges will request a real certificate from Let's
  Encrypt production — mind the rate limits if redeploying repeatedly.

Checklist

• Commit messages follow Conventional Commits
• Commits are signed off (git commit -s) per the DCO
• cargo fmt --all clean
• cargo clippy --workspace --all-targets -- -D warnings clean
• cargo test --workspace passes
• Wire-format / protocol changes have a corresponding update in docs/protocol.md — n/a, no protocol changes
• Crypto changes have a corresponding update in docs/MLS_SECURIotocol_deviations.md — n/a, TLS cert sourcing only