The web UI's certificate from Let's Encrypt, through Jarl

tls.acme names the certificate and jarl: the Jarl server and a token that
may only write the challenge record. Steward gets the certificate with
DNS-01 (lego), writing the record through Jarl's API into every view that
has the zone, renews it with a third of its lifetime left and swaps it
in without a restart. A check runs before every order: Jarl, the zone,
the token's permission, a test record, the zone's name servers, public
resolvers, clean-up; each step says what to fix. Staging by default.

With a certificate, each listener serves HTTPS and plain HTTP on one port
(redirecting plain HTTP, except from the server itself).

steward cert / cert check / cert renew, Server -> Certificate in the web
UI, GET /certificate, POST /certificate/check|renew. docs/certificates.md
and docs/jarl.md (the Jarl user and the token's grant).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/config/config_test.go

@@ -22,12 +22,18 @@ func TestExampleIsTheDefaults(t *testing.T) {
 
 func TestErrors(t *testing.T) {
 	cases := map[string]string{
-		"listen: []":                  "listen",
-		"database: relative.db":       "database",
-		"session: {cookie_secure: x}": "cookie_secure",
-		"tls: {cert_file: /a}":        "tls",
-		"no_such_setting: 1":          "no_such_setting",
-		"backup: {retention: 3x}":     "duration",
+		"listen: []":                                "listen",
+		"database: relative.db":                     "database",
+		"session: {cookie_secure: x}":               "cookie_secure",
+		"tls: {cert_file: /a}":                      "tls",
+		"no_such_setting: 1":                        "no_such_setting",
+		"backup: {retention: 3x}":                   "duration",
+		"tls: {acme: {domain: dhcp.example.com}}":   "needs Jarl",
+		"jarl: {server: https://dns.example.com}":   "token or token_file",
+		"jarl: {server: dns.example.com, token: x}": "Jarl's URL",
+		"{tls: {cert_file: /a, key_file: /b, acme: {domain: d.example.com}}, jarl: {server: https://j, token: x}}": "can't both",
+		"{tls: {acme: {domain: '*.example.com'}}, jarl: {server: https://j, token: x}}":                            "full name",
+		"{tls: {acme: {domain: d.example.com, directory: http://x}}, jarl: {server: https://j, token: x}}":         "https://",
 	}
 	for yml, want := range cases {
 		path := filepath.Join(t.TempDir(), "s.yaml")