fix(ansible): add become, gate pcsclite install, fix package names

[tod-uma]

Summary

• become: The role runs system-level operations (package install, user/group
  creation, directory creation, binary download, systemd management) but declared
  no become: true on any task or handler, causing failures when Ansible connects
  as an unprivileged user. Added become: true to all tasks that require root, and
  to both handlers (which do not inherit become from the notifying task).

• become_user: The binary install tasks (slurp, get_url, copy) now use
  become_user: acme-proxy. The install directory is mode 0750 owned by the
  service user, so temp file creation fails when running as root.

• libpcsclite: Added acme_proxy_install_pcsc (default: true) to gate the
  package install. Despite the docs stating libpcsclite is only required for source
  builds, the pre-built binary is dynamically linked against libpcsclite.so.1 and
  will not start without it (error while loading shared libraries: libpcsclite.so.1).
  Also corrected the package names from build-time devel packages to the runtime
  libraries: pcsc-lite-devel → pcsc-lite (RedHat), libpcsclite-dev →
  libpcsclite1 (Debian).

Test plan

• Run role against an EL9 host as an unprivileged Ansible user — all tasks
  complete without privilege errors
• Verify acme-proxy.service starts cleanly (libpcsclite.so.1 found)
• Run with --check --diff — no live GitHub API call when version is pinned
• Set acme_proxy_install_pcsc: false — package task is skipped

🤖 Generated with Claude Code