The web UI's certificate from Let's Encrypt, through Jarl

tls.acme names the certificate and jarl: the Jarl server and a token that
may only write the challenge record. Steward gets the certificate with
DNS-01 (lego), writing the record through Jarl's API into every view that
has the zone, renews it with a third of its lifetime left and swaps it
in without a restart. A check runs before every order: Jarl, the zone,
the token's permission, a test record, the zone's name servers, public
resolvers, clean-up; each step says what to fix. Staging by default.

With a certificate, each listener serves HTTPS and plain HTTP on one port
(redirecting plain HTTP, except from the server itself).

steward cert / cert check / cert renew, Server -> Certificate in the web
UI, GET /certificate, POST /certificate/check|renew. docs/certificates.md
and docs/jarl.md (the Jarl user and the token's grant).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/permissions.md

@@ -10,6 +10,8 @@ else gets **grants**, `resource:access`:
 | `config` | settings, subnets, reservations, history, interfaces (the web UI shows the forms locked) | change them, undo, import |
 | `leases` | leases and DHCP activity | delete a lease (making a reservation from one needs `config:write` too) |
 | `audit` | the audit log | – |
+
+The certificate (`steward cert`, Server → Certificate) is for administrators only.
 | `*` | all of the above | |
 
 **Roles** are ready-made sets of grants: