Certificate export, missing PTR list, simpler "Used for"

- Certificates can be exported for use outside Jarl: Export… on the
  Certificates page (download or copy), jarl cert export, and
  GET /certificates/{name}/pem?part=fullchain|cert|key|bundle.
  Administrators only; key exports are audited.
- A reverse zone's missing-PTR banner lists the addresses and names
  (ptr_missing_list in the zone API).
- "Used for" shows DoT/DoH for named, and "not used by Jarl" instead of
  "nothing yet".

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -8,6 +8,15 @@ All notable changes to Jarl are documented here. The format follows
 
 ### Added
 
+- Certificates can be exported for use outside Jarl: **Export…** on the
+  Certificates page (download, or copy to the clipboard),
+  `jarl cert export NAME [--dir DIR | --part PART]`
+  and `GET /certificates/{name}/pem?part=fullchain|cert|key|bundle`.
+  Administrators only; every export of the private key is audited
+  (`certificate.export_key`).
+- A reverse zone's "addresses have no PTR record" banner lists them, with
+  the name each would get, instead of only counting them
+  (`ptr_missing_list` in the zone API).
 - A zone's page links to the same zone in the other views ("also in
   external"), in each view's colour, keeping the tab you are on. It
   works for zones that aren't linked too, and the zone API's new
@@ -18,6 +27,11 @@ All notable changes to Jarl are documented here. The format follows
 
 ### Changed
 
+- The Certificates page's "Used for" column says DoT and DoH for named,
+  with the addresses in the tooltip, instead of listing every address. A
+  certificate with no use says "not used by Jarl" rather than "nothing
+  yet": it may well be used elsewhere.
+
 - Deleting a linked zone's local records (an override) removes that name
   and type from that view only. It used to bring the shared records back
   into the view, so a delete looked undone. The other views keep their