TLS certificates: Jarl obtains and renews them over ACME

Jarl is now an ACME client (lego's core, no DNS providers). It answers
DNS-01 challenges in a zone it serves, or through Porkbun's DNS API while
Porkbun serves the domain; "auto" decides from the domain's public name
servers at every renewal, and a CNAME on _acme-challenge is followed.
Certificates are used for jarld's HTTPS (served without a restart; each
port speaks HTTPS and plain HTTP, plain HTTP from loopback and trusted
proxies still served) and/or written for named's DNS over TLS/HTTPS, with
rndc reconfig on renewal. Renewal follows the CA's ARI window or two
thirds of the lifetime, with back-off. Certificates you renew yourself
can be used too. Certificates page and dashboard card, jarl cert,
/api/v1/certificates, Prometheus gauges, docs/certificates.md, and an
e2e section against Pebble.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/server/routes.go

@@ -162,6 +162,14 @@ func (s *Server) routes() {
 	m.HandleFunc("POST "+p+"/acme/httpreq/view/{view}/present", s.httpreq(true))
 	m.HandleFunc("POST "+p+"/acme/httpreq/view/{view}/cleanup", s.httpreq(false))
 	// Query statistics
+	m.HandleFunc("GET "+p+"/certificates", s.authed(s.certList))
+	m.HandleFunc("POST "+p+"/certificates", s.authed(s.certCreate))
+	m.HandleFunc("POST "+p+"/certificates/check", s.authed(s.certCheck))
+	m.HandleFunc("GET "+p+"/certificates/{name}", s.authed(s.certGet))
+	m.HandleFunc("PATCH "+p+"/certificates/{name}", s.authed(s.certUpdate))
+	m.HandleFunc("DELETE "+p+"/certificates/{name}", s.authed(s.certDelete))
+	m.HandleFunc("POST "+p+"/certificates/{name}/issue", s.authed(s.certIssue))
+	m.HandleFunc("POST "+p+"/certificates/{name}/check", s.authed(s.certCheck))
 	m.HandleFunc("GET "+p+"/exposure", s.authed(s.exposure))
 	m.HandleFunc("POST "+p+"/exposure/fix", s.authed(s.exposureFix))
 	m.HandleFunc("POST "+p+"/exposure/ack", s.authed(s.exposureAck(true)))