The web UI's certificate from Let's Encrypt, through Jarl

tls.acme names the certificate and jarl: the Jarl server and a token that
may only write the challenge record. Steward gets the certificate with
DNS-01 (lego), writing the record through Jarl's API into every view that
has the zone, renews it with a third of its lifetime left and swaps it
in without a restart. A check runs before every order: Jarl, the zone,
the token's permission, a test record, the zone's name servers, public
resolvers, clean-up; each step says what to fix. Staging by default.

With a certificate, each listener serves HTTPS and plain HTTP on one port
(redirecting plain HTTP, except from the server itself).

steward cert / cert check / cert renew, Server -> Certificate in the web
UI, GET /certificate, POST /certificate/check|renew. docs/certificates.md
and docs/jarl.md (the Jarl user and the token's grant).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -83,6 +83,25 @@ and a CLI, built the way Jarl is.
 - **`stewardd`** commands: `init` (asks for the administrator's name),
   `user add|password|token`, `check`, `backup` (with pruning), `restore`,
   `config --example`.
+- **The web UI's certificate from Let's Encrypt, through Jarl**
+  (docs/certificates.md, docs/jarl.md):
+  - `tls.acme` in `steward.yaml` names the certificate, and `jarl:` the
+    Jarl server and a token that may only write the challenge record.
+  - Steward gets the certificate with the DNS-01 challenge, writing the
+    record through Jarl's API into every view that has the zone.
+  - It renews with a third of the lifetime left, and swaps the new
+    certificate in without a restart.
+  - A check runs before every order, and on demand: Jarl, the zone, the
+    token's permission, a test record, the zone's public name servers and
+    public resolvers, clean-up. Each step says what to fix.
+  - It starts with Let's Encrypt's staging service by default.
+  - `steward cert`, `cert check`, `cert renew`; Server → Certificate in the
+    web UI; `GET /certificate`, `POST /certificate/check|renew`.
+  - Dashboard problems: `certificate_failed`, `certificate_expiring`,
+    `certificate_staging`.
+- **HTTPS and plain HTTP on one port:** with a certificate, plain HTTP is
+  redirected to HTTPS, except from the server itself (also for
+  `tls.cert_file`).
 - **Token rotation** (`steward token rotate`, `POST /tokens/{id}/rotate`,
   Rotate in the web UI): a new secret for a token, with an optional grace
   period for the old one, as in Jarl.