Encrypted DNS: several host names, views per listen address, what named uses a certificate for

The setup takes several host names (one certificate for all; the health check says when the served certificate misses one), stored in the settings. Each listen address gets its own views for the host names' A/AAAA records (--address ADDR=VIEW,..., a view checkbox per address in the form), always local to the view, with a warning when a public view would get a private address; a view no longer given loses the address, other records of the names stay, and the form starts from where the records are now. Certificates (page and jarl cert show) say what named uses each for: DNS over TLS or HTTPS, on which addresses and ports.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/e2e.sh

@@ -901,6 +901,13 @@ if [ -n "$PEBBLE" ]; then
 	sleep 16   # /metrics caches Jarl's state for 15 seconds
 	run "health metric" 0 curl -sf http://127.0.0.1:$HTTP/metrics
 	contains "^jarl_encrypted_dns_up{kind=\"dot\",address=\"127.0.0.1\",port=\"$EDOT\"} 1$"
+	run "cert show: what named uses it for" 0 $J cert show ns1
+	contains "^named: *DNS over TLS on 127.0.0.1 port $EDOT"
+	contains "^named: *DNS over HTTPS on 127.0.0.1 port $EDOH"
+	run "per address views: 127.0.0.1 only in internal" 0 $J encrypted-dns setup --hostname ns1.adbraun.test --address 127.0.0.1=internal --dot-port $EDOT --doh-port $EDOH
+	run "status shows where the records are" 0 $J encrypted-dns
+	contains "^Records: *127.0.0.1 in internal$"
+	contains "^Host names: *ns1.adbraun.test$"
 	run "a certificate named uses can't be deleted (exit 6)" 6 $J cert delete ns1 --yes
 	contains "take it out first"
 	run "encrypted-dns disable" 0 $J encrypted-dns disable