TLS certificates: Jarl obtains and renews them over ACME

Jarl is now an ACME client (lego's core, no DNS providers). It answers
DNS-01 challenges in a zone it serves, or through Porkbun's DNS API while
Porkbun serves the domain; "auto" decides from the domain's public name
servers at every renewal, and a CNAME on _acme-challenge is followed.
Certificates are used for jarld's HTTPS (served without a restart; each
port speaks HTTPS and plain HTTP, plain HTTP from loopback and trusted
proxies still served) and/or written for named's DNS over TLS/HTTPS, with
rndc reconfig on renewal. Renewal follows the CA's ARI window or two
thirds of the lifetime, with back-off. Certificates you renew yourself
can be used too. Certificates page and dashboard card, jarl cert,
/api/v1/certificates, Prometheus gauges, docs/certificates.md, and an
e2e section against Pebble.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/store/store.go

@@ -332,6 +332,35 @@ CREATE TABLE client_groups (
 	`
 ALTER TABLE views ADD COLUMN exposure TEXT NOT NULL DEFAULT '';
 ALTER TABLE views ADD COLUMN acknowledged TEXT NOT NULL DEFAULT '[]';
+`,
+	// 10: TLS certificates (docs/certificates.md). cert_pem and key_pem
+	// hold the current certificate of one Jarl obtains.
+	`
+CREATE TABLE certificates (
+	id INTEGER PRIMARY KEY,
+	name TEXT NOT NULL UNIQUE,
+	source TEXT NOT NULL,
+	domains TEXT NOT NULL DEFAULT '[]',
+	cert_file TEXT NOT NULL DEFAULT '',
+	key_file TEXT NOT NULL DEFAULT '',
+	uses TEXT NOT NULL DEFAULT '[]',
+	challenge TEXT NOT NULL DEFAULT '',
+	key_type TEXT NOT NULL DEFAULT '',
+	comment TEXT NOT NULL DEFAULT '',
+	cert_pem TEXT NOT NULL DEFAULT '',
+	key_pem TEXT NOT NULL DEFAULT '',
+	names TEXT NOT NULL DEFAULT '[]',
+	not_before TEXT, not_after TEXT,
+	issuer TEXT NOT NULL DEFAULT '',
+	serial TEXT NOT NULL DEFAULT '',
+	renew_at TEXT, ari_checked_at TEXT,
+	last_attempt TEXT, last_success TEXT,
+	last_error TEXT NOT NULL DEFAULT '',
+	failures INTEGER NOT NULL DEFAULT 0,
+	last_routes TEXT NOT NULL DEFAULT '[]',
+	created_at TEXT NOT NULL, updated_at TEXT NOT NULL,
+	created_by TEXT NOT NULL DEFAULT '', updated_by TEXT NOT NULL DEFAULT ''
+);
 `,
 }