Make a bench fully operable without root after install

Privileged operations (nginx, certbot, supervisor, modsecurity) now run once in root installer pass or through scoped sudoers; bench user no longer needs passwordless sudo.