Certificates for other hosts: jarl cert get

jarld obtains and renews a certificate for another host; the host asks
for it with one command, waits, downloads it when it is newer than its
copy and runs a hook with the paths in JARL_CERT_* variables.

- Certificates have an owner user; another user can't take the name.
  An existing one is obtained again only when a name is added or
  removed. A new certificates grant (names=) says which names a user
  may have; it is never part of "*". Users may own
  certificates.max_per_user certificates (10) or their own cert_limit.
- POST /certificates/{name}/request; owners may list, show, export and
  delete theirs; keys only over HTTPS, the socket or loopback; every
  download is recorded and shown as "Pulled by".
- CLI: jarl cert get (saved settings, all saved when no name), cert
  saved, cert forget, cert schedule (daily systemd timer, Linux, root).
- Migration 14. Tests: server, auth, and e2e against Pebble.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -8,6 +8,21 @@ All notable changes to Jarl are documented here. The format follows
 
 ### Added
 
+- Certificates for other hosts: `jarl cert get NAME -d DOMAIN --dir DIR
+  --hook CMD` on a mail server or proxy has jarld obtain the certificate
+  (and renew it), waits, downloads it when it is newer than the host's
+  copy, and runs the hook with the file paths in `JARL_CERT_*`
+  variables. Its settings are saved, so `jarl cert get` alone refreshes
+  them all; `jarl cert schedule` writes a daily systemd timer for that;
+  `jarl cert saved` lists them with their expiry; `jarl cert forget`
+  stops one. A certificate belongs to the user that asked for it (other
+  users can't take the name), is obtained again only when a name is
+  added or removed, and the Certificates page shows its owner and who
+  downloaded it, flagging hosts that haven't fetched a renewal. A new
+  `certificates` grant (`certificates:write names=*.adbraun.lol`) says
+  which names a user may have; it is never part of `*`. Users may own
+  `certificates.max_per_user` certificates (10), or their own
+  `--cert-limit`. API: `POST /certificates/{name}/request`.
 - Certificates can be exported for use outside Jarl: **Export…** on the
   Certificates page (download, or copy to the clipboard),
   `jarl cert export NAME [--dir DIR | --part PART]`
@@ -27,6 +42,10 @@ All notable changes to Jarl are documented here. The format follows
 
 ### Changed
 
+- A certificate's private key is only exported over HTTPS, the local
+  socket, or to the server itself (plain HTTP from another host is
+  refused with `https_required`).
+
 - The Certificates page's "Used for" column says DoT and DoH for named,
   with the addresses in the tooltip, instead of listing every address. A
   certificate with no use says "not used by Jarl" rather than "nothing
@@ -97,6 +116,12 @@ All notable changes to Jarl are documented here. The format follows
   the zone now keep the dot, and the name server is only sent when it was
   changed.
 
+### Upgrading
+
+- The database gains a migration (certificate owners, per-user
+  certificate limits, certificate downloads). Going back to an older
+  version afterwards means restoring a backup made before the upgrade.
+
 ## [0.6.0] - 2026-10-13
 
 ### Added