Certificate export, missing PTR list, simpler "Used for"

- Certificates can be exported for use outside Jarl: Export… on the
  Certificates page (download or copy), jarl cert export, and
  GET /certificates/{name}/pem?part=fullchain|cert|key|bundle.
  Administrators only; key exports are audited.
- A reverse zone's missing-PTR banner lists the addresses and names
  (ptr_missing_list in the zone API).
- "Used for" shows DoT/DoH for named, and "not used by Jarl" instead of
  "nothing yet".

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/server/certs_test.go

@@ -165,3 +165,39 @@ func TestHTTPSAndPlainOnOnePort(t *testing.T) {
 		t.Errorf("no certificate: %d %s", rec.Code, rec.Body.String())
 	}
 }
+
+// A certificate's files can be exported for use elsewhere; the key only
+// by an administrator, audited.
+func TestCertificateExport(t *testing.T) {
+	env := newAPIEnv(t)
+	withCerts(env)
+	certFile, keyFile := selfSigned(t, t.TempDir(), "mail.example.com")
+	env.do("POST", "/certificates", env.token, map[string]any{"name": "mail", "source": "file", "cert_file": certFile, "key_file": keyFile}, 201)
+	chain, _ := os.ReadFile(certFile)
+	key, _ := os.ReadFile(keyFile)
+	for part, want := range map[string]string{"": string(chain), "fullchain": string(chain), "cert": string(chain), "key": string(key), "bundle": string(key) + "\n" + string(chain)} {
+		b, status := env.req("GET", "/certificates/mail/pem?part="+part, env.token, nil)
+		if status != 200 || string(b) != want {
+			t.Errorf("part %q: %d %q", part, status, b)
+		}
+	}
+	if _, status := env.req("GET", "/certificates/mail/pem?part=nope", env.token, nil); status != 400 {
+		t.Errorf("bad part: %d", status)
+	}
+	if _, status := env.req("GET", "/certificates/none/pem", env.token, nil); status != 404 {
+		t.Errorf("no such certificate: %d", status)
+	}
+	// Not for a user who isn't an administrator.
+	hash, _ := auth.HashPassword("pw-pw-pw-pw")
+	u := &model.User{Username: "ops", PasswordHash: hash, Grants: []model.Grant{{Resource: "*", Access: "write"}}}
+	env.st.CreateUser(context.Background(), u)
+	tok, pid, sh := auth.NewToken()
+	env.st.CreateToken(context.Background(), &model.Token{UserID: u.ID, Name: "t", PublicID: pid, SecretHash: sh})
+	if _, status := env.req("GET", "/certificates/mail/pem?part=key", tok, nil); status != 403 {
+		t.Errorf("non-admin: %d", status)
+	}
+	audit, _ := env.req("GET", "/audit?action=certificate.export_key", env.token, nil)
+	if n := strings.Count(string(audit), "certificate.export_key"); n != 2 {
+		t.Errorf("audited key exports: %d (%s)", n, audit)
+	}
+}