Issue real certificates via ACME DNS-01

Tunnels now get a per-tunnel certificate from the configured ACME CA
(Let's Encrypt by default) with DNS-01 through Porkbun, keeping the
client's CSR and key. Issuance is asynchronous (issuing/ready/failed);
the account persists in the store, renewals run in a 30-day window with
retries, and a failed renewal keeps the old certificate serving.
Switching from the local CA reissues existing tunnels automatically,
and the admin dashboard shows the issuer and certificate state.

Verified against Pebble and Let's Encrypt staging.

internal/server/dns_challtestsrv.go

@@ -0,0 +1,62 @@
+package server
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"time"
+)
+
+// ChallengeTestSrvDNS talks to pebble-challtestsrv's management API, for
+// development against a local Pebble ACME server (DNS_PROVIDER=challtestsrv).
+type ChallengeTestSrvDNS struct {
+	BaseURL string // default http://127.0.0.1:8055
+	HTTP    *http.Client
+}
+
+func (c *ChallengeTestSrvDNS) base() string {
+	if c.BaseURL != "" {
+		return c.BaseURL
+	}
+	return "http://127.0.0.1:8055"
+}
+
+func (c *ChallengeTestSrvDNS) client() *http.Client {
+	if c.HTTP != nil {
+		return c.HTTP
+	}
+	return &http.Client{Timeout: 10 * time.Second}
+}
+
+func (c *ChallengeTestSrvDNS) post(ctx context.Context, path string, body map[string]string) error {
+	raw, err := json.Marshal(body)
+	if err != nil {
+		return err
+	}
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, c.base()+path, bytes.NewReader(raw))
+	if err != nil {
+		return err
+	}
+	req.Header.Set("Content-Type", "application/json")
+	resp, err := c.client().Do(req)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		data, _ := io.ReadAll(io.LimitReader(resp.Body, 512))
+		return fmt.Errorf("challtestsrv %s: HTTP %d: %s", path, resp.StatusCode, data)
+	}
+	return nil
+}
+
+func (c *ChallengeTestSrvDNS) CreateTXT(ctx context.Context, name, value string) error {
+	return c.post(ctx, "/set-txt", map[string]string{"host": name, "value": value})
+}
+
+func (c *ChallengeTestSrvDNS) DeleteTXT(ctx context.Context, name string) error {
+	return c.post(ctx, "/clear-txt", map[string]string{"host": name})
+}