Initial implementation of certforge ACME certificate manager

Rust CLI tool for automated ACME certificate management with:
- DNS-01 challenge via RFC 2136 dynamic DNS updates with TSIG auth
- DANE TLSA record publication (RFC 6698/7671/7672)
- systemd credential integration (systemd-creds encrypt/decrypt)
- systemd unit management via D-Bus (zbus)
- Post-renewal hooks (systemctl reload/restart, arbitrary commands)
- Key rotation with DANE pre-publication protocol
- TOML configuration with per-zone DNS overrides

Tested against Let's Encrypt staging. 12 unit tests, zero warnings.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/error.rs

@@ -0,0 +1,39 @@
+use std::path::PathBuf;
+
+#[derive(Debug, thiserror::Error)]
+pub enum Error {
+    #[error("ACME error: {0}")]
+    Acme(#[from] instant_acme::Error),
+
+    #[error("DNS update failed: {0}")]
+    DnsUpdate(String),
+
+    #[error("certificate error: {0}")]
+    Certificate(String),
+
+    #[error("key error: {0}")]
+    Key(String),
+
+    #[error("config error: {0}")]
+    Config(String),
+
+    #[error("credential {name} not found at {path}")]
+    CredentialNotFound { name: String, path: PathBuf },
+
+    #[error("systemd-creds failed: {0}")]
+    SystemdCreds(String),
+
+    #[error("hook {hook} failed: {message}")]
+    Hook { hook: String, message: String },
+
+    #[error("state error: {0}")]
+    State(String),
+
+    #[error(transparent)]
+    Io(#[from] std::io::Error),
+
+    #[error(transparent)]
+    Other(#[from] anyhow::Error),
+}
+
+pub type Result<T> = std::result::Result<T, Error>;