Add guarded IP certificate flow and renewal history

backend/internal/tlsservice/renewals_test.go

@@ -0,0 +1,22 @@
+package tlsservice
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestReadRenewalEventsAcceptsOnlyBoundedValidRecords(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "renewals.log")
+	content := "2026-10-26T08:00:00Z\ttest-link.appx365.com\n" +
+		"2026-10-26T09:00:00Z\t121.4.111.208\n" +
+		"invalid\t121.4.111.208\n" +
+		"2026-10-26T10:00:00Z\t../bad\n"
+	if err := os.WriteFile(path, []byte(content), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	events := readRenewalEvents(path)
+	if len(events) != 2 || events[0].Host != "121.4.111.208" || events[1].Host != "test-link.appx365.com" {
+		t.Fatalf("renewal events = %+v", events)
+	}
+}