feat(backends): filesystem + DSM install backends

[albedosehen]

Stacked on #1 (namecheap CA + registrar). Marked draft until the parent merges; will retarget to main afterward.

Summary

Lands the two install backends rota's first operator needs: plain filesystem (any nginx/Caddy/HAProxy/rustls consumer) and Synology DSM (example.com's actual host).

FilesystemInstall

Writes four files in the configured directory using the certbot naming convention so existing reload scripts work unchanged:

• <id>.crt — leaf cert
• <id>.chain.crt — intermediate chain only
• <id>.fullchain.crt — leaf + chain concatenated
• <id>.key — private key (mode 0600); cert files are 0644

Each artifact goes through write to .tmp.<n> → fsync → rename so a crash mid-install can never leave a half-written file visible to the consuming service. Parent directory is created if missing for ergonomics; existing files overwrite idempotently.

DsmInstall

Shells out to synowebapi --exec api=SYNO.Core.Certificate:

1. method=list — find the existing entry whose desc matches the configured description.
2. Stage cert/chain/key into a per-install tempdir.
3. method=import with the staged paths and optional id=<existing> so re-imports update in place rather than create duplicates. DSM reloads its own nginx as part of import.

synowebapi only exists on a running DSM box, so the binary call itself is exercised on the host; CI tests cover the JSON parsing (list/import response shapes) and the staging step (file presence + modes).

Dispatch

backends::build_from_config now matches both InstallSpec variants and returns concrete trait objects. The CertBackends.install field is no longer always None.

Test plan

• cargo fmt --all -- --check
• cargo clippy --workspace --all-targets -- -D warnings clean
• cargo test --workspace — 18 passing (10 new)
  • filesystem: file presence + 0644/0600 modes, fullchain ordering, missing-directory creation, overwrite idempotency, concat_pem newline edge cases
  • dsm: stage() writes three files with correct modes, list response parses (with + without data), import-error envelope surfaces
  • config: filesystem InstallSpec variant round-trips
• End-to-end exercise on the host: full DSM import with example.com cert (after PR-3 lands the scheduler)

What's not in this PR

• Daemon scheduler loop, UNIX socket, SQLite audit DB (PR-3)
• Dashboard (PR-4)
• ACME / Let's Encrypt CA backend