Permissions: a certificates role

A template for tokens and users that get certificates for other hosts
(jarl cert get): certificates:write, to narrow with names= in the web
UI's "Insert a template…", or --role certificates in the CLI. The token
form's template filter no longer counts "*" as covering certificates,
as the server doesn't.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -6,6 +6,13 @@ All notable changes to Jarl are documented here. The format follows
 
 ## [Unreleased]
 
+### Added
+
+- A `certificates` role (template): `certificates:write`, for tokens and
+  users that get certificates for other hosts with `jarl cert get`. In
+  the web UI's user and token forms it is in "Insert a template…", to
+  narrow with `names=`; in the CLI, `--role certificates`.
+
 ## [0.6.1] - 2026-10-20
 
 ### Added