TLS certificates: Jarl obtains and renews them over ACME

Jarl is now an ACME client (lego's core, no DNS providers). It answers
DNS-01 challenges in a zone it serves, or through Porkbun's DNS API while
Porkbun serves the domain; "auto" decides from the domain's public name
servers at every renewal, and a CNAME on _acme-challenge is followed.
Certificates are used for jarld's HTTPS (served without a restart; each
port speaks HTTPS and plain HTTP, plain HTTP from loopback and trusted
proxies still served) and/or written for named's DNS over TLS/HTTPS, with
rndc reconfig on renewal. Renewal follows the CA's ARI window or two
thirds of the lifetime, with back-off. Certificates you renew yourself
can be used too. Certificates page and dashboard card, jarl cert,
/api/v1/certificates, Prometheus gauges, docs/certificates.md, and an
e2e section against Pebble.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/static/assets/style.css

@@ -509,3 +509,7 @@ pre.optval { padding: 5px 8px; border: 1px solid transparent; background: none;
 /* ...and the editor in a table cell gets the same width, so the column
    doesn't jump when Edit opens. */
 td textarea.code { min-width: min(72ch, 50vw); }
+
+/* Certificates: the "check the names" result under the ACME fields. */
+.check-names { margin: 6px 0 14px; }
+.check-names .table-wrap { margin-top: 8px; }