enhance(acme): add configurable ACME profile (#39375)

Adds server-side ACME profile configuration so operators can select a
non-default ACME profile. This covers issuers such as Let's Encrypt
where raw-IP certificate issuance requires the `shortlived` profile.

Fixes: #39374
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: techknowlogick <164197+techknowlogick@users.noreply.github.com>
Co-authored-by: techknowlogick <techknowlogick@gitea.com>
Co-authored-by: silverwind <me@silverwind.io>

modules/setting/server.go

@@ -101,6 +101,7 @@ var (
 	AcmeLiveDirectory          string
 	AcmeEmail                  string
 	AcmeURL                    string
+	AcmeProfile                string
 	AcmeCARoot                 string
 	SSLMinimumVersion          string
 	SSLMaximumVersion          string
@@ -171,6 +172,7 @@ func loadServerFrom(rootCfg ConfigProvider) {
 		Protocol = HTTPS
 		if EnableAcme {
 			AcmeURL = sec.Key("ACME_URL").MustString("")
+			AcmeProfile = sec.Key("ACME_PROFILE").MustString("")
 			AcmeCARoot = sec.Key("ACME_CA_ROOT").MustString("")
 
 			if sec.HasKey("ACME_ACCEPTTOS") {