The web UI's certificate from Let's Encrypt, through Jarl

tls.acme names the certificate and jarl: the Jarl server and a token that
may only write the challenge record. Steward gets the certificate with
DNS-01 (lego), writing the record through Jarl's API into every view that
has the zone, renews it with a third of its lifetime left and swaps it
in without a restart. A check runs before every order: Jarl, the zone,
the token's permission, a test record, the zone's name servers, public
resolvers, clean-up; each step says what to fix. Staging by default.

With a certificate, each listener serves HTTPS and plain HTTP on one port
(redirecting plain HTTP, except from the server itself).

steward cert / cert check / cert renew, Server -> Certificate in the web
UI, GET /certificate, POST /certificate/check|renew. docs/certificates.md
and docs/jarl.md (the Jarl user and the token's grant).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

cmd/stewardd/main.go

@@ -23,9 +23,11 @@ import (
 	"golang.org/x/term"
 
 	"steward/internal/auth"
+	"steward/internal/certs"
 	"steward/internal/config"
 	"steward/internal/dhcpd"
 	"steward/internal/engine"
+	"steward/internal/jarl"
 	"steward/internal/model"
 	"steward/internal/server"
 	"steward/internal/store"
@@ -153,10 +155,23 @@ func serveCmd() *cobra.Command {
 			for _, p := range eng.Problems() {
 				a.log.Warn("configuration problem: "+p.Message, "object", p.Object, "code", p.Code)
 			}
+			var acme *certs.Manager
+			if a.cfg.TLS.ACME.Domain != "" {
+				tok, err := a.cfg.Jarl.ReadToken()
+				if err != nil {
+					return err
+				}
+				jc, err := jarl.New(a.cfg.Jarl.Server, tok, a.cfg.Jarl.CACert, a.cfg.Jarl.Insecure)
+				if err != nil {
+					return err
+				}
+				acme = certs.New(ctx, certs.Config{ACME: a.cfg.TLS.ACME, Version: version.Short()}, jc, a.store, a.log)
+				go acme.Run(ctx)
+			}
 			srv := server.New(server.Config{
 				Listen: a.cfg.Listen, TLSCertFile: a.cfg.TLS.CertFile, TLSKeyFile: a.cfg.TLS.KeyFile, TrustedProxies: a.cfg.Proxies(),
 				SessionLifetime: time.Duration(a.cfg.Session.Lifetime), SessionIdle: time.Duration(a.cfg.Session.IdleTimeout),
-				CookieSecure: a.cfg.Session.CookieSecure, Socket: a.cfg.Socket, PingProblem: pinger.Problem,
+				CookieSecure: a.cfg.Session.CookieSecure, Socket: a.cfg.Socket, PingProblem: pinger.Problem, ACME: acme,
 			}, eng, d, host, a.log, web.FS())
 			go d.Run(ctx)
 			hup := make(chan os.Signal, 1)