Add an httpreq endpoint for lego and Traefik

jarld can now answer lego's httpreq DNS provider
(POST /api/v1/acme/httpreq/present and /cleanup), so lego and Traefik
publish DNS-01 challenges with only environment variables, without the
jarl CLI. lego's username and API token arrive as HTTP Basic auth,
accepted on these routes only.

The endpoint is off by default (acme.httpreq.enabled) and HTTPS-only by
default: jarld's own TLS, or a trusted proxy that says so with
X-Forwarded-Proto or Forwarded (the last value counts). Plain HTTP can be
allowed from loopback only or everywhere. GET /api/v1/acme/httpreq shows
how jarld sees a request, to check a proxy setup.

jarl acme and the endpoint share their code in internal/acme. Documented
in docs/acme.md, configuration.md, api.md and permissions.md.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/configuration.md

@@ -20,7 +20,7 @@ The CLI has its own small configuration file, described in [cli.md](cli.md).
 |-----|---------|---------|
 | `listen` | `["127.0.0.1:8053"]` | Addresses to listen on (`host:port`, several allowed). Keep these on localhost and management networks. |
 | `tls.cert_file`, `tls.key_file` | (empty: plain HTTP) | PEM certificate chain and key. Both or neither. The files are rechecked every 10 minutes and on SIGHUP (`systemctl reload jarl`), so renewed certificates are used without a restart. |
-| `trusted_proxies` | `[]` | Addresses or prefixes of reverse proxies whose `X-Forwarded-For` and `X-Forwarded-Proto` headers are believed. Needed for correct client IPs in the audit log and for rate limiting behind a proxy. |
+| `trusted_proxies` | `[]` | Addresses or prefixes of reverse proxies whose `X-Forwarded-For` and `X-Forwarded-Proto` (or `Forwarded: proto=`) headers are believed. Needed for correct client IPs in the audit log and for rate limiting behind a proxy, and for knowing that a proxied request came over HTTPS (the session cookie's Secure flag, `acme.httpreq`). From other addresses these headers are ignored. |
 | `session.lifetime` | `12h` | A web session ends this long after login... |
 | `session.idle_timeout` | `2h` | ...or after this long without requests. |
 | `session.cookie_secure` | `auto` | `auto` sets the cookie's Secure flag when the request came over HTTPS (directly or via a trusted proxy); `always` / `never` force it. |
@@ -51,6 +51,20 @@ The `stats:` section turns on query statistics (off by default). See
 [stats.md](stats.md) for every setting and what it changes in named's
 configuration. Changing it takes effect when jarld restarts.
 
+### ACME (lego httpreq endpoint)
+
+An endpoint for lego's `httpreq` DNS provider, so lego and Traefik can
+publish DNS-01 challenges without the jarl CLI. See
+[acme.md](acme.md#6-lego-and-traefik-over-http-httpreq-without-the-jarl-cli)
+for how it works and how to set up HTTPS for it. Changes take effect when
+jarld restarts.
+
+| Key | Default | Meaning |
+|-----|---------|---------|
+| `acme.httpreq.enabled` | `false` | Answer `POST /api/v1/acme/httpreq/present` and `/cleanup`. Off, they answer `404 disabled`. |
+| `acme.httpreq.require_https` | `true` | Refuse requests that didn't come over HTTPS: jarld's own `tls`, or a proxy in `trusted_proxies` that sends `X-Forwarded-Proto: https`. The rest of Jarl is unaffected by this setting. `false` accepts plain HTTP from anywhere (logged as a warning at startup). |
+| `acme.httpreq.allow_loopback_http` | `false` | Also accept plain HTTP from `127.0.0.1` and `::1` (lego on the DNS server itself), unless that address is in `trusted_proxies`. |
+
 ### BIND
 
 | Key | Default | Meaning |
@@ -107,3 +121,9 @@ location / {
     proxy_read_timeout 300s;   # applying a large changeset can take a while
 }
 ```
+
+`X-Forwarded-Proto` tells jarld that the client used HTTPS. It sets the
+session cookie's Secure flag, and the lego `httpreq` endpoint needs it
+(Caddy and Traefik send it without being told). Check with
+`curl https://YOUR-PROXY/api/v1/acme/httpreq`, whose `transport` field says
+how jarld saw the request.