The web UI's certificate from Let's Encrypt, through Jarl

tls.acme names the certificate and jarl: the Jarl server and a token that
may only write the challenge record. Steward gets the certificate with
DNS-01 (lego), writing the record through Jarl's API into every view that
has the zone, renews it with a third of its lifetime left and swaps it
in without a restart. A check runs before every order: Jarl, the zone,
the token's permission, a test record, the zone's name servers, public
resolvers, clean-up; each step says what to fix. Staging by default.

With a certificate, each listener serves HTTPS and plain HTTP on one port
(redirecting plain HTTP, except from the server itself).

steward cert / cert check / cert renew, Server -> Certificate in the web
UI, GET /certificate, POST /certificate/check|renew. docs/certificates.md
and docs/jarl.md (the Jarl user and the token's grant).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -47,6 +47,11 @@ network: it greets it, gives it an address, and tells it the way around
   administrator, or `config`, `leases` and `audit` access, read or write.
   On the server itself, root needs no setup: the CLI uses stewardd's local
   socket.
+* **HTTPS on its own.** Give it a name and a Jarl token, and Steward gets its
+  web UI's certificate from Let's Encrypt and renews it, with Jarl
+  publishing the DNS-01 challenge. It checks the whole path first, so a
+  broken setup never wastes Let's Encrypt's rate limits
+  ([docs/certificates.md](docs/certificates.md)).
 * **One small service.** `stewardd` is one static binary, run by a
   sandboxed systemd unit whose only privilege is binding port 67. Debian
   packages and a daily backup timer are included.
@@ -89,6 +94,8 @@ sudo systemctl disable --now kea-dhcp4-server
 * [subnets.md](docs/subnets.md): subnets, interfaces, pools, reservations, options, leases, and how addresses are chosen
 * [options.md](docs/options.md): the options Steward knows and how to write their values
 * [kea.md](docs/kea.md): moving from Kea
+* [certificates.md](docs/certificates.md): HTTPS with a certificate from Let's Encrypt, through Jarl
+* [jarl.md](docs/jarl.md): connecting Steward to Jarl, and what its token may do
 * [cli.md](docs/cli.md): the `steward` command line client
 * [api.md](docs/api.md): the REST API
 * [configuration.md](docs/configuration.md): `/etc/steward/steward.yaml`