Certificate export, missing PTR list, simpler "Used for"

- Certificates can be exported for use outside Jarl: Export… on the
  Certificates page (download or copy), jarl cert export, and
  GET /certificates/{name}/pem?part=fullchain|cert|key|bundle.
  Administrators only; key exports are audited.
- A reverse zone's missing-PTR banner lists the addresses and names
  (ptr_missing_list in the zone API).
- "Used for" shows DoT/DoH for named, and "not used by Jarl" instead of
  "nothing yet".

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/server/h_certs.go

@@ -2,6 +2,7 @@ package server
 
 import (
 	"context"
+	"encoding/pem"
 	"errors"
 	"net/http"
 	"time"
@@ -116,6 +117,51 @@ func (s *Server) certGet(w http.ResponseWriter, r *http.Request, p *auth.Princip
 	return nil
 }
 
+// certPEM: GET /certificates/{name}/pem?part=fullchain|cert|key|bundle,
+// the certificate as PEM for use elsewhere: the chain (default), the
+// certificate alone, the private key, or the key followed by the chain
+// (one file, as HAProxy wants). Anything with the key is audited.
+func (s *Server) certPEM(w http.ResponseWriter, r *http.Request, p *auth.Principal) error {
+	if err := s.certsReady(p); err != nil {
+		return err
+	}
+	part := r.URL.Query().Get("part")
+	if part == "" {
+		part = "fullchain"
+	}
+	c, chain, key, err := s.cfg.Certs.PEM(r.Context(), r.PathValue("name"))
+	if err != nil {
+		return certErr(err)
+	}
+	var out []byte
+	file := c.Name + "-" + part + ".pem"
+	switch part {
+	case "fullchain":
+		out = chain
+	case "cert":
+		if b, _ := pem.Decode(chain); b != nil {
+			out = pem.EncodeToMemory(b)
+		}
+	case "key":
+		out = key
+	case "bundle":
+		out = append(append(append([]byte{}, key...), '\n'), chain...)
+	default:
+		return badRequest("part must be fullchain, cert, key or bundle")
+	}
+	if len(out) == 0 {
+		return badRequest("certificate %s has no %s", c.Name, part)
+	}
+	if part == "key" || part == "bundle" {
+		s.eng.Audit(r.Context(), p, "certificate.export_key", "certificate", c.ID, c.Name, "success", "exported the private key ("+part+")")
+	}
+	w.Header().Set("Content-Type", "application/x-pem-file")
+	w.Header().Set("Content-Disposition", `attachment; filename="`+file+`"`)
+	w.Header().Set("Cache-Control", "no-store")
+	_, err = w.Write(out)
+	return err
+}
+
 // certCreate: POST /certificates. With "issue": true (the default for
 // certificates Jarl obtains) it is obtained before the answer.
 func (s *Server) certCreate(w http.ResponseWriter, r *http.Request, p *auth.Principal) error {