acme-dns.nix: one systemd attrset (statix W20) — lint gate green

statix flagged the repeated `systemd.` keys (tmpfiles marker, acme-dns
daemon, traefik handoff oneshot); they are now one nested attrset. Purely
structural: `#cc-ci` still evaluates. With #33 this makes the push
self-test's lint stage pass again.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FqkQq3CDmFWcQ7u1LzoyRz

nix/modules/acme-dns.nix

@@ -60,18 +60,24 @@ in
 
   environment.etc."acme-dns/lego.env".source = legoEnvironment;
 
-  # The staging order has completed successfully. This marker permits the
-  # production ACME post-run hook to hand a renewed certificate to Traefik.
-  systemd.tmpfiles.rules = [
-    "f /var/lib/ci-certs/acme-production-enabled 0600 root root -"
-  ];
 
   networking.firewall = {
     allowedTCPPorts = [ 53 ];
     allowedUDPPorts = [ 53 ];
   };
 
-  systemd.services.acme-dns = {
+
+
+  # One `systemd` attrset (statix W20): the tmpfiles marker, the acme-dns daemon and the
+  # traefik handoff oneshot.
+  systemd = {
+    # The staging order has completed successfully. This marker permits the
+    # production ACME post-run hook to hand a renewed certificate to Traefik.
+    tmpfiles.rules = [
+      "f /var/lib/ci-certs/acme-production-enabled 0600 root root -"
+    ];
+
+    services.acme-dns = {
       description = "Restricted authoritative DNS for cc-ci ACME DNS-01";
       wantedBy = [ "multi-user.target" ];
       after = [ "network-online.target" ];
@@ -100,7 +106,7 @@ in
     # Traefik consumes its wildcard as immutable Swarm secrets, so a renewed
     # host certificate must be copied and reconciled rather than merely reloaded.
     # This service is started only by the production-mode ACME postRun hook.
-  systemd.services.cc-ci-acme-traefik-handoff = {
+    services.cc-ci-acme-traefik-handoff = {
       description = "Install renewed cc-ci wildcard into Traefik Swarm secrets";
       after = [ "docker.service" "deploy-proxy.service" ];
       requires = [ "docker.service" ];
@@ -134,6 +140,7 @@ in
           while IFS= read -r stale; do docker secret rm "$stale" || true; done
       '';
     };
+  };
 
   security.acme = {
     acceptTerms = true;