Use the certs/ fallback in every environment

TLS no longer depends on NODE_ENV: the TLS_* variables win, else certs/
is used whenever it exists (the container's /app/certs mount lands there
too), and TLS_DISABLED=1 is the only way to serve plain HTTP with a
certificate present. The plain-HTTP redirect listener now starts whenever
TLS is on, not only in development, and HTTP_REDIRECT_PORT replaces
DEV_HTTP_PORT. The installer writes TLS_DISABLED=1 for --no-https, and the
health check follows the same rule.

src/dict/env-dict.ts

@@ -38,8 +38,9 @@ export type KnownEnv = {
  *
  * Not here, and never in the `envs` table: `ENCRYPTION_KEY` and
  * `ENCRYPTION_SALT` (they encrypt the table), and `PORT`, `DATA_DIR`,
- * `MAIN_SERVER` and the `TLS_*` certificate paths (the container's own
- * start-up settings). Those stay in the process environment.
+ * `MAIN_SERVER`, `TLS_DISABLED`, `HTTP_REDIRECT_PORT` and the `TLS_*`
+ * certificate paths (the container's own start-up settings). Those stay in
+ * the process environment.
  */
 export const EnvDict: readonly KnownEnv[] = [
     {
@@ -89,6 +90,8 @@ export const ProcessOnlyEnvKeys = [
     "TLS_CERT_FILE",
     "TLS_KEY_FILE",
     "TLS_CA_FILE",
+    "TLS_DISABLED",
+    "HTTP_REDIRECT_PORT",
 ] as const;
 
 /**