Check TLS certificate expiry from CT logs

Reads Certificate Transparency logs and reports days remaining on the certificate most likely deployed right now (the unexpired entry with the latest not_before). Relevant as CA/Browser Forum rules shrink standard certificate lifetimes toward 47 days by 2029.

Billing. $0.05 per successful call. Failed calls are never billed. Charged against prepaid credits when the balance covers it, otherwise metered to your card. Threat Intelligence subscribers and AWS Marketplace bundle customers call this at no extra charge.

Note. cert_found: true with days_remaining: null and risk_level: CRITICAL means historical certificates exist but none are currently valid -- distinct from cert_found: false, which means the domain has never appeared in CT logs.