TLS certificates: Jarl obtains and renews them over ACME

Jarl is now an ACME client (lego's core, no DNS providers). It answers
DNS-01 challenges in a zone it serves, or through Porkbun's DNS API while
Porkbun serves the domain; "auto" decides from the domain's public name
servers at every renewal, and a CNAME on _acme-challenge is followed.
Certificates are used for jarld's HTTPS (served without a restart; each
port speaks HTTPS and plain HTTP, plain HTTP from loopback and trusted
proxies still served) and/or written for named's DNS over TLS/HTTPS, with
rndc reconfig on renewal. Renewal follows the CA's ARI window or two
thirds of the lifetime, with back-off. Certificates you renew yourself
can be used too. Certificates page and dashboard card, jarl cert,
/api/v1/certificates, Prometheus gauges, docs/certificates.md, and an
e2e section against Pebble.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/development.md

@@ -118,7 +118,13 @@ checker tests work with the installed `bind9-utils` too.
 ACME hooks, DNSSEC signing, backup and restore with keys, audit) and checks
 the answers with `dig`. The Porkbun code is tested against
 `porkbun.Fake`, an in-memory stand-in for its API; nothing calls the real
-one. `KEEP=1` leaves named
+one. With Docker, certificates are tested end to end against
+[Pebble](https://github.com/letsencrypt/pebble), Let's Encrypt's test CA
+(`ghcr.io/letsencrypt/pebble`, host network, ports 14000 and 15000),
+which checks the challenges against the test named: obtaining, HTTPS
+from jarld, DNS over TLS from named, renewal. `PEBBLE=0` skips that; the
+certs package's own tests use a fake DNS server and `porkbun.Fake`, and
+never a real CA. `KEEP=1` leaves named
 and jarld running afterwards. The output says where; set `JARL_CLI_CONFIG`
 to that directory's `cli.yaml` to keep using the CLI against it.