Certificate export, missing PTR list, simpler "Used for"

- Certificates can be exported for use outside Jarl: Export… on the
  Certificates page (download or copy), jarl cert export, and
  GET /certificates/{name}/pem?part=fullchain|cert|key|bundle.
  Administrators only; key exports are audited.
- A reverse zone's missing-PTR banner lists the addresses and names
  (ptr_missing_list in the zone API).
- "Used for" shows DoT/DoH for named, and "not used by Jarl" instead of
  "nothing yet".

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/model/certificate.go

@@ -39,7 +39,8 @@ type Certificate struct {
 	Comment   string   `json:"comment"`
 
 	// The current certificate: acme source only (a file source's is read
-	// from its files). The key never leaves the server through the API.
+	// from its files). The key leaves the server only through the
+	// administrators' export (GET /certificates/{name}/pem), audited.
 	CertPEM string `json:"-"`
 	KeyPEM  string `json:"-"`