feat: add download command to retrieve PEM bundle from Key Vault

src/lib/provisioner.ts

@@ -131,6 +131,13 @@ export class Provisioner {
     return result;
   }
 
+  async download(domain: string): Promise<string> {
+    const certName = domainToCertName(domain);
+    const pem = await this.store.getSecret(certName);
+    if (!pem) throw new Error(`Certificate not found in KeyVault: ${certName}`);
+    return pem;
+  }
+
   async scan(): Promise<DomainRecord[]> {
     return scanDnsZones(this.credential, this.config);
   }