Serve plain HTTP only and drop the local certificate tooling

The app never terminates TLS: a reverse proxy or tunnel does, and
isSecureRequest still reads X-Forwarded-Proto so cookies stay Secure.
Removes the cert generator, TLS resolution and HTTP redirect, the
local CA download, and the TLS envs, and trims the installer, Dockerfile
health check and docs to match. Also softens the composer's loading row.

.env.example

@@ -17,15 +17,8 @@ DEV_EMAIL_RECIPIENT=
 ENCRYPTION_KEY=
 ENCRYPTION_SALT=
 
-# HTTPS (see README). Generate files with `bun run gen:certs`; when these
-# are empty the server uses certs/ if it exists, in every environment. Set
-# TLS_DISABLED=1 to serve plain HTTP even when a certificate is there.
-TLS_CERT_FILE=
-TLS_KEY_FILE=
-TLS_CA_FILE=
-TLS_DISABLED=
-# Plain-HTTP port that redirects to the HTTPS one (default PORT + 1).
-HTTP_REDIRECT_PORT=
+# The app serves plain HTTP. Put a reverse proxy or tunnel in front for
+# HTTPS (see README).
 
 # Web Push: generated into Settings > Environment on first start. Set a
 # fixed pair here only if you want to keep one across installs.