Certificates for other hosts: jarl cert get

jarld obtains and renews a certificate for another host; the host asks
for it with one command, waits, downloads it when it is newer than its
copy and runs a hook with the paths in JARL_CERT_* variables.

- Certificates have an owner user; another user can't take the name.
  An existing one is obtained again only when a name is added or
  removed. A new certificates grant (names=) says which names a user
  may have; it is never part of "*". Users may own
  certificates.max_per_user certificates (10) or their own cert_limit.
- POST /certificates/{name}/request; owners may list, show, export and
  delete theirs; keys only over HTTPS, the socket or loopback; every
  download is recorded and shown as "Pulled by".
- CLI: jarl cert get (saved settings, all saved when no name), cert
  saved, cert forget, cert schedule (daily systemd timer, Linux, root).
- Migration 14. Tests: server, auth, and e2e against Pebble.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/store/store.go

@@ -384,6 +384,22 @@ ALTER TABLE zones ADD COLUMN auto_ptr INTEGER NOT NULL DEFAULT 0;
 	`
 ALTER TABLE views ADD COLUMN reverse_suggestions_off INTEGER NOT NULL DEFAULT 0;
 ALTER TABLE views ADD COLUMN dismissed_reverse TEXT NOT NULL DEFAULT '[]';
+`,
+	// 14: certificates for other hosts (docs/certificates.md#certificates-for-other-hosts):
+	// an owner, a per-user limit, and who downloaded them.
+	`
+ALTER TABLE certificates ADD COLUMN owner_id INTEGER NOT NULL DEFAULT 0;
+ALTER TABLE users ADD COLUMN cert_limit INTEGER;
+CREATE TABLE certificate_pulls (
+	cert_id INTEGER NOT NULL REFERENCES certificates(id) ON DELETE CASCADE,
+	who TEXT NOT NULL,
+	user_id INTEGER NOT NULL DEFAULT 0,
+	token_id INTEGER NOT NULL DEFAULT 0,
+	serial TEXT NOT NULL DEFAULT '',
+	ip TEXT NOT NULL DEFAULT '',
+	at TEXT NOT NULL,
+	PRIMARY KEY (cert_id, who)
+);
 `,
 }