feat: add crt.sh certificate transparency lookup plugin

Query CT logs via crt.sh to enumerate SSL certs for domains,
report expired/valid counts, and flag live expired certs.
Uses ThreadPoolExecutor(3) for blocking I/O on RPi5.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docs/CHEATSHEET.md

@@ -20,6 +20,7 @@ derp -v               # Verbose/debug mode
 !help <cmd>        # Command help
 !version           # Bot version
 !echo <text>       # Echo text back
+!cert <domain>     # CT log lookup (max 5 domains)
 ```
 
 ## Plugin Template