The web UI's certificate from Let's Encrypt, through Jarl

tls.acme names the certificate and jarl: the Jarl server and a token that
may only write the challenge record. Steward gets the certificate with
DNS-01 (lego), writing the record through Jarl's API into every view that
has the zone, renews it with a third of its lifetime left and swaps it
in without a restart. A check runs before every order: Jarl, the zone,
the token's permission, a test record, the zone's name servers, public
resolvers, clean-up; each step says what to fix. Staging by default.

With a certificate, each listener serves HTTPS and plain HTTP on one port
(redirecting plain HTTP, except from the server itself).

steward cert / cert check / cert renew, Server -> Certificate in the web
UI, GET /certificate, POST /certificate/check|renew. docs/certificates.md
and docs/jarl.md (the Jarl user and the token's grant).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/cli.md

@@ -129,6 +129,16 @@ sent.
 `steward import kea CONFIG [--leases FILE]... [--interface PREFIX=IFACE]... [--replace]`:
 see [kea.md](kea.md).
 
+### cert
+
+Administrators only ([certificates.md](certificates.md)).
+
+| Command | |
+|---|---|
+| `cert` | the certificate: name, CA, validity, renewal, the last check |
+| `cert check` | check that the challenge can be published through Jarl and seen, without the CA (fails with exit code 1 if it can't) |
+| `cert renew [-w]` | get a new certificate now; `-w` waits and shows the result |
+
 ### users, tokens, audit
 
 | Command | |