TLS/certificate visibility: expiry, issuance status, runtime cert state

[gsmlg]

Problem

There is currently no way to answer the #1 operational question for a Caddy deployment: which certificates does Caddy hold, when do they expire, and did issuance fail?

Caddy.Admin.Resources.get_tls/0 reads the TLS configuration, not runtime certificate state.

Proposal

• Surface cert data from the PKI Admin API (depends on the missing PKI endpoints) and/or Caddy's Prometheus metrics endpoint
• Expose something like Caddy.certificates/0 returning subjects, issuers, and expiry
• Emit telemetry (e.g. [:caddy, :tls, :cert_expiring]) so applications can alert on upcoming expiry or failed issuance