Certificate export, missing PTR list, simpler "Used for"

- Certificates can be exported for use outside Jarl: Export… on the
  Certificates page (download or copy), jarl cert export, and
  GET /certificates/{name}/pem?part=fullchain|cert|key|bundle.
  Administrators only; key exports are audited.
- A reverse zone's missing-PTR banner lists the addresses and names
  (ptr_missing_list in the zone API).
- "Used for" shows DoT/DoH for named, and "not used by Jarl" instead of
  "nothing yet".

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/server/present.go

@@ -41,7 +41,11 @@ func (s *Server) presentZone(st *model.State, z *model.Zone, counts map[int64]re
 	if pf, ok := dnsname.PrefixFromReverse(z.Name); ok {
 		out.Prefix = pf.String()
 		if z.Type == model.ZonePrimary {
-			out.PTRMissing = len(engine.PTRFills(st, z.ViewID, z.Name, st.ZoneRecords(z.ID)))
+			fills := engine.PTRFills(st, z.ViewID, z.Name, st.ZoneRecords(z.ID))
+			out.PTRMissing = len(fills)
+			for _, f := range fills[:min(len(fills), 25)] {
+				out.PTRMissingList = append(out.PTRMissingList, api.PTRFill(f))
+			}
 		}
 	}
 	for _, o := range st.LinkedWith(z) {