Certificates for other hosts: jarl cert get

jarld obtains and renews a certificate for another host; the host asks
for it with one command, waits, downloads it when it is newer than its
copy and runs a hook with the paths in JARL_CERT_* variables.

- Certificates have an owner user; another user can't take the name.
  An existing one is obtained again only when a name is added or
  removed. A new certificates grant (names=) says which names a user
  may have; it is never part of "*". Users may own
  certificates.max_per_user certificates (10) or their own cert_limit.
- POST /certificates/{name}/request; owners may list, show, export and
  delete theirs; keys only over HTTPS, the socket or loopback; every
  download is recorded and shown as "Pulled by".
- CLI: jarl cert get (saved settings, all saved when no name), cert
  saved, cert forget, cert schedule (daily systemd timer, Linux, root).
- Migration 14. Tests: server, auth, and e2e against Pebble.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/model/certificate.go

@@ -62,11 +62,27 @@ type Certificate struct {
 	// LastRoutes says where the challenges went the last time ("adbraun.lol: porkbun").
 	LastRoutes []string `json:"last_routes,omitempty"`
 
+	// OwnerID is the user a certificate for another host belongs to
+	// (jarl cert get); 0 for the administrators' own.
+	OwnerID int64 `json:"owner_id,omitempty"`
+
 	CreatedAt time.Time `json:"created_at"`
 	UpdatedAt time.Time `json:"updated_at"`
 	CreatedBy string    `json:"created_by"`
 	UpdatedBy string    `json:"updated_by"`
 }
 
+// CertificatePull records that someone downloaded a certificate: who
+// ("token NAME" or "user NAME"), which one (Serial), when and from where.
+type CertificatePull struct {
+	CertID  int64     `json:"-"`
+	Who     string    `json:"who"`
+	UserID  int64     `json:"user_id,omitempty"`
+	TokenID int64     `json:"token_id,omitempty"`
+	Serial  string    `json:"serial"`
+	IP      string    `json:"ip,omitempty"`
+	At      time.Time `json:"at"`
+}
+
 // HasUse reports whether c is used for use.
 func (c *Certificate) HasUse(use string) bool { return slices.Contains(c.Uses, use) }

internal/model/changeset.go

@@ -76,6 +76,9 @@ type User struct {
 	TOTPSecret    string     `json:"-"`
 	TOTPPending   string     `json:"-"`
 	TOTPLastStep  int64      `json:"-"`
+	// CertLimit is how many certificates the user may own (jarl cert get);
+	// nil: certificates.max_per_user in jarl.yaml.
+	CertLimit *int `json:"cert_limit,omitempty"`
 }
 
 // HasTOTP reports whether the user logs in with a TOTP code.