fix: read API_TOKEN from database in certbot hooks

[Upellift99]

Summary

• Certbot sanitizes subprocess environment, stripping API_TOKEN from certbot hook scripts (certbot-auth.py, certbot-cleanup.py, certbot-deploy.py)
• Hooks fail to authenticate with the BunkerWeb API, preventing certificate issuance/renewal
• Fix: retrieve API_TOKEN from the database via db.get_non_default_settings() (already available through DATABASE_URI which certbot preserves) instead of relying on getenv("API_TOKEN")

Fixes #3295

Validation steps

1. Deploy BunkerWeb with AUTO_LETS_ENCRYPT=yes on a service
2. Trigger certificate issuance (add a new service or wait for renewal)
3. Verify in scheduler logs that the certbot hooks successfully authenticate and the certificate is issued
4. Verify that manual certbot renew also works correctly

Files changed

• src/common/core/letsencrypt/jobs/certbot-auth.py
• src/common/core/letsencrypt/jobs/certbot-cleanup.py
• src/common/core/letsencrypt/jobs/certbot-deploy.py

🤖 Generated with Claude Code