The web UI's certificate from Let's Encrypt, through Jarl

tls.acme names the certificate and jarl: the Jarl server and a token that
may only write the challenge record. Steward gets the certificate with
DNS-01 (lego), writing the record through Jarl's API into every view that
has the zone, renews it with a third of its lifetime left and swaps it
in without a restart. A check runs before every order: Jarl, the zone,
the token's permission, a test record, the zone's name servers, public
resolvers, clean-up; each step says what to fix. Staging by default.

With a certificate, each listener serves HTTPS and plain HTTP on one port
(redirecting plain HTTP, except from the server itself).

steward cert / cert check / cert renew, Server -> Certificate in the web
UI, GET /certificate, POST /certificate/check|renew. docs/certificates.md
and docs/jarl.md (the Jarl user and the token's grant).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/validation.md

@@ -63,3 +63,14 @@ These apply to options anywhere (settings, subnets, reservations).
 | `reservation_client_taken` | error | the client has a reservation in this subnet already (one per subnet; a device on two VLANs may have one in each) |
 | `reservation_hostname` | error | not a host name (letters, digits and `-`, labels up to 63 characters) |
 | `reservation_server_address` | warning, host | the server's own address |
+
+## Certificate
+
+Not configuration problems, but shown with them on the dashboard and in
+`steward status`, to administrators ([certificates.md](certificates.md)):
+
+| Code | | When |
+|---|---|---|
+| `certificate_failed` | warning | the last attempt to get the web UI's certificate failed (the message says where) |
+| `certificate_expiring` | warning | the certificate ends in less than 14 days and hasn't been renewed |
+| `certificate_staging` | warning | the certificate is from Let's Encrypt's staging service, which browsers don't trust |