TLS certificates: Jarl obtains and renews them over ACME

Jarl is now an ACME client (lego's core, no DNS providers). It answers
DNS-01 challenges in a zone it serves, or through Porkbun's DNS API while
Porkbun serves the domain; "auto" decides from the domain's public name
servers at every renewal, and a CNAME on _acme-challenge is followed.
Certificates are used for jarld's HTTPS (served without a restart; each
port speaks HTTPS and plain HTTP, plain HTTP from loopback and trusted
proxies still served) and/or written for named's DNS over TLS/HTTPS, with
rndc reconfig on renewal. Renewal follows the CA's ARI window or two
thirds of the lifetime, with back-off. Certificates you renew yourself
can be used too. Certificates page and dashboard card, jarl cert,
/api/v1/certificates, Prometheus gauges, docs/certificates.md, and an
e2e section against Pebble.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/dnssec.md

@@ -175,13 +175,17 @@ Before you go public:
 ## Porkbun
 
 With a Porkbun API key, Jarl manages a domain's name servers, glue records
-and DS records at Porkbun, and checks each change before making it.
+and DS records at Porkbun, and checks each change before making it. The
+same key also lets Jarl publish the DNS-01 challenges of its own
+certificates while Porkbun serves the domain's DNS
+([certificates.md](certificates.md#where-the-challenge-goes)).
 
 **Setting it up**
 
 1. At porkbun.com, *Account → API Access*: create a key. If you can,
-   limit it to the domain and the permissions it needs (domains, read),
-   and to your server's address.
+   limit it to the domain and the permissions it needs, and to your
+   server's address. The registrar features need the domain permissions;
+   certificate challenges need DNS record write access too.
 2. On the domain's page, switch **API Access** on (Porkbun refuses API
    calls for a domain until you do).
 3. Put the key in `/etc/jarl/jarl.yaml` and restart jarld: