Changelog

Add optional Aleph and Netty integrations for automatic HTTPS with HTTP-01 and TLS-ALPN-01 validation, dynamic SNI certificate selection, and certificate renewal without restarting listeners.

Add a Protocol53-backed DNS-01 Challenge Solver with explicit Provider construction, exact Record ownership and cleanup, bounded propagation checks, and credential-safe Trove telemetry. Protocol53 and Provider artifacts remain optional and do not change Clave’s base runtime dependencies.

Replace the singleton get-event-queue API with independent bounded subscribe-events queues and explicit unsubscribe-events cleanup.

Disconnect only overflowing subscribers, and deliver event-shaped subscription, overflow, and system shutdown notifications.

Replace the two-argument polling-only ol.clave.ext.common/wait-for-certificates API with a five-argument event-aware waiter; callers must subscribe before manage-domains and unsubscribe in finally, and Aleph and Ring Jetty now report structured permanent initial failures immediately.

Make post-issuance ARI fetching automatic and remove the automation-layer :ari configuration option.

Replace the vendored Babashka HTTP client and interceptor chain with java.net.http; :http-client now accepts a java.net.http.HttpClient directly.