Add read-only NPM certificate discovery

dns_sync/certificates/models.py

@@ -0,0 +1,35 @@
+from dataclasses import dataclass
+from datetime import datetime
+
+
+@dataclass(frozen=True)
+class CertificateIdentity:
+    """
+    Cluster identity for a certificate.
+
+    NPM numeric IDs are intentionally excluded because they are node-local.
+    """
+
+    domains: tuple[str, ...]
+
+    @property
+    def key(self) -> str:
+        return ",".join(self.domains)
+
+
+@dataclass(frozen=True)
+class CertificateState:
+    """
+    Non-secret certificate state suitable for discovery, comparison, and logs.
+    """
+
+    identity: CertificateIdentity
+    local_id: int
+    provider: str
+    nice_name: str
+    valid_from: datetime | None
+    expires_on: datetime | None
+    cluster_managed: bool
+    acme_renew: bool
+    dns_challenge: bool
+    source: str