feat(tls): add certificate readiness checks

[bymoye]

Refs #31. Depends on #39, #37, and #34. Related server capability work: nazozero/NazoAuth#130

Outcome

Adds a read-only tls certificate check command for external monitoring and early renewal alerting. A successful check proves the deployment declaration, provider authority, committed receipt, active generation files, certificate source, remaining validity, and real public TLS/HTTP endpoint in one bounded snapshot, then emits a short-lived readiness document.

Safety and ownership boundary

• takes the deployment shared lock, reloads the declaration inside it, requires the granted proxy_tls authority, and takes the provider shared lock so certificate apply, ACME issue, permission changes, and readiness evidence cannot cross one another;
• refuses any pending certificate transaction or provider activation writer before inspecting committed state;
• requires the active current symlink and current provider config/trust/public URL to match the authoritative certificate receipt;
• reopens the active generation's certificate and private key, independently revalidates chain, exact SAN, serverAuth use, validity, and key match, and compares raw certificate/key, material, leaf, and not-after identities with the source-bound receipt;
• when the installed source is ACME, revalidates the current issuance receipt/account/private artifacts and requires that exact issuance authority to still be the installed source; a newer uninstalled or pending issuance fails the check;
• performs bounded public DNS resolution, rejects non-public addresses, performs a real TLS handshake, checks the exact served leaf digest, and requires an accepted HTTP health status;
• fails before and after public verification when the certificate is at or inside the larger of provider minimum_validity_seconds and optional --warning-window-seconds (3600 through 7776000);
• emits success only with a new UUIDv7 and five-minute evidence expiry capped at certificate_not_after - warning_window, plus deployment/declaration/tenant/hostname/revision/source/provider/material/public bindings.

The command creates no scheduler, journal, certificate, reload, or deployment mutation. Operators run it from their existing monitoring scheduler; ctl remains absent from the authentication request path and may be stopped between checks.

Responsibility choice

Readiness composes existing owners instead of duplicating them: provider loading and activation receipts remain in the certificate module, offline PKI remains in material, ACME authority remains in acme, and public black-box verification remains in public_endpoint. No NazoAuth version, Direct TLS capability, proxy configuration, tenant runtime selection, or protocol-key behavior is inferred.

Verification

Local Windows, exact commit b5224c02f0ae457b3b21dce9bbd50c67aef4fb68:

• cargo fmt --all -- --check
• git diff --check and staged patch check
• cargo check --workspace --all-targets --all-features --locked
• cargo clippy --workspace --all-targets --all-features --locked -- -D warnings — no issues
• cargo test --workspace --all-targets --all-features --locked — 366 passed
• cargo build --locked --workspace --all-targets --all-features --release — 0 errors; three informational MSVC import-library linker messages
• release-binary tls --help smoke shows the read-only external-monitoring contract

Focused verification: 24 TLS tests and 2 TLS CLI parser tests passed. The new cases cover warning-window default/max behavior, exact boundary failure, active material/source drift, unique/typed CLI inputs, and retained existing public TLS identity/health tests.

Remote GitHub CI passed 13/13 checks on exact head b5224c02f0ae457b3b21dce9bbd50c67aef4fb68, including Linux, macOS, Windows, signed-server compatibility, and real Docker/Podman/systemd discovery.

Not yet verified / not claimed

• no real provider directory, public certificate endpoint, Nginx/Angie reload, renewal alert integration, remote deployment, or stopped-ctl acceptance run was exercised;
• no background scheduling/notification service is included; monitoring integration owns invocation frequency and delivery;
• no standalone Direct TLS, Nginx/Angie configuration generation, trusted-proxy/internal transport change, or NazoAuth capability negotiation was implemented;
• no merge, release, deployment, or tag operation is performed by this PR.