Certificate export, missing PTR list, simpler "Used for"

- Certificates can be exported for use outside Jarl: Export… on the
  Certificates page (download or copy), jarl cert export, and
  GET /certificates/{name}/pem?part=fullchain|cert|key|bundle.
  Administrators only; key exports are audited.
- A reverse zone's missing-PTR banner lists the addresses and names
  (ptr_missing_list in the zone API).
- "Used for" shows DoT/DoH for named, and "not used by Jarl" instead of
  "nothing yet".

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/server/routes.go

@@ -174,6 +174,7 @@ func (s *Server) routes() {
 	m.HandleFunc("POST "+p+"/certificates", s.authed(s.certCreate))
 	m.HandleFunc("POST "+p+"/certificates/check", s.authed(s.certCheck))
 	m.HandleFunc("GET "+p+"/certificates/{name}", s.authed(s.certGet))
+	m.HandleFunc("GET "+p+"/certificates/{name}/pem", s.authed(s.certPEM))
 	m.HandleFunc("PATCH "+p+"/certificates/{name}", s.authed(s.certUpdate))
 	m.HandleFunc("DELETE "+p+"/certificates/{name}", s.authed(s.certDelete))
 	m.HandleFunc("POST "+p+"/certificates/{name}/issue", s.authed(s.certIssue))