Use the certs/ fallback in every environment

TLS no longer depends on NODE_ENV: the TLS_* variables win, else certs/
is used whenever it exists (the container's /app/certs mount lands there
too), and TLS_DISABLED=1 is the only way to serve plain HTTP with a
certificate present. The plain-HTTP redirect listener now starts whenever
TLS is on, not only in development, and HTTP_REDIRECT_PORT replaces
DEV_HTTP_PORT. The installer writes TLS_DISABLED=1 for --no-https, and the
health check follows the same rule.

install.sh

@@ -963,6 +963,7 @@ ensure_secret ENCRYPTION_SALT
 ensure_env PAGE_LASTMOD_FILE "/data/sitemap-lastmod.json"
 
 if [ "$HTTPS_ENABLED" = 1 ]; then
+    unset_env TLS_DISABLED
     set_env TLS_CERT_FILE /app/certs/server.crt
     set_env TLS_KEY_FILE /app/certs/server.key
     if [ "$HTTPS_MANAGED" = 1 ]; then
@@ -974,6 +975,7 @@ else
     unset_env TLS_CERT_FILE
     unset_env TLS_KEY_FILE
     unset_env TLS_CA_FILE
+    set_env TLS_DISABLED 1
 fi
 
 {