fix ACME: set default group to nginx for webroot permissions

The ACME challenge directory was created with group 'acme' but nginx
needs read access to serve challenge responses. Setting defaults.group
to 'nginx' ensures all ACME directories are accessible by nginx.

modules/nixos/nginx/default.nix

@@ -62,6 +62,7 @@ in
       acceptTerms = true;
       defaults.email = mkDefault "postmaster@${config.networking.domain}";
       defaults.webroot = mkDefault "/var/lib/acme/acme-challenge";
+      defaults.group = mkDefault "nginx";
     };
 
     security.dhparams = mkIf cfg.forceSSL {