Serve plain HTTP only and drop the local certificate tooling

The app never terminates TLS: a reverse proxy or tunnel does, and
isSecureRequest still reads X-Forwarded-Proto so cookies stay Secure.
Removes the cert generator, TLS resolution and HTTP redirect, the
local CA download, and the TLS envs, and trims the installer, Dockerfile
health check and docs to match. Also softens the composer's loading row.

Dockerfile

@@ -5,10 +5,9 @@ LABEL org.opencontainers.image.title="Cobble" \
       org.opencontainers.image.source="https://github.com/Moduletrace/cobble" \
       org.opencontainers.image.licenses="MIT"
 
-# openssl generates the local CA and certificate the installer serves HTTPS
-# with (`src/scripts/generate-local-certs.ts`).
+# The app serves plain HTTP; HTTPS is the reverse proxy's job.
 RUN apt-get update \
-    && apt-get install -y --no-install-recommends curl bash nano wget zip unzip openssl \
+    && apt-get install -y --no-install-recommends curl bash nano wget zip unzip \
     && rm -rf /var/lib/apt/lists/*
 
 ENV NODE_ENV=production
@@ -33,6 +32,6 @@ COPY entrypoint.sh /entrypoint.sh
 RUN chmod +x /entrypoint.sh
 
 HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
-    CMD if [ -z "$TLS_DISABLED" ] && ( [ -n "$TLS_CERT_FILE" ] || [ -f /app/certs/server.crt ] ); then curl -fsSk "https://localhost:${PORT:-7227}/api/health" || exit 1; else curl -fsS "http://localhost:${PORT:-7227}/api/health" || exit 1; fi
+    CMD curl -fsS "http://localhost:${PORT:-7227}/api/health" || exit 1
 
 ENTRYPOINT ["/entrypoint.sh"]