Security hints: public CT history lookup

[mortenn]

Part of #249 and meta #245.

Scope

Implement an optional public certificate transparency history lookup vector.

• Query public CT data for a domain or host, not the full URL.
• Prefer a no-key provider such as crt.sh for an initial implementation if reliability is acceptable.
• Consider Censys only as a bring-your-own-account provider because it requires API access and credits.
• Keep this separate from the existing manual TLS check, which already inspects embedded SCT evidence.

Acceptance Notes

• Disabled by default and user-triggered only.
• Explain which CT provider receives the domain or host.
• Respect provider rate limits with caching and neutral failure states.
• Do not treat provider unavailability as a security warning.
• Do not send full URLs.

Out of Scope

• RDAP domain registration metadata.
• URL malware/reputation checks.
• Automatic external checks.