Fix gosec, govet, and errorlint linter errors

Co-authored-by: Junie <junie@jetbrains.com>

internal/acme/nonce.go

@@ -13,9 +13,9 @@ const nonceLifetime = 10 * time.Minute
 // NonceStore is a thread-safe single-use nonce store with expiry.
 // Nonces are short-lived per RFC 8555 §7.2.
 type NonceStore struct {
-	mu     sync.Mutex
 	nonces map[string]time.Time
 	issued int
+	mu     sync.Mutex
 }
 
 // NewNonceStore creates a new nonce store.