Serve plain HTTP only and drop the local certificate tooling

The app never terminates TLS: a reverse proxy or tunnel does, and
isSecureRequest still reads X-Forwarded-Proto so cookies stay Secure.
Removes the cert generator, TLS resolution and HTTP redirect, the
local CA download, and the TLS envs, and trims the installer, Dockerfile
health check and docs to match. Also softens the composer's loading row.

src/data/app-data.ts

@@ -45,16 +45,6 @@ export const AppData = {
     LegacyHarnessOverviewStorageKey: `${SiteData["SiteSlug"]}_harness_overview`,
     HarnessOverviewCacheMs: 10 * 60 * 1000,
     ServerHealthMessage: "Server Running Well",
-    /**
-     * Where a device downloads the local CA that signed the app's
-     * certificate, so it can trust it (`serveLocalCa`): the certificate
-     * and an iOS/macOS profile that installs it, and the names they
-     * download as. Only served with TLS and `TLS_CA_FILE`.
-     */
-    TlsCaPath: "/ca.crt",
-    TlsCaFilename: `${SiteData["SiteSlug"]}-ca.crt`,
-    TlsCaProfilePath: "/ca.mobileconfig",
-    TlsCaProfileFilename: `${SiteData["SiteSlug"]}-ca.mobileconfig`,
     AuthKeyCookieName: `${SiteData["SiteSlug"]}_auth_key`,
     AuthCSRFCookieName: `${SiteData["SiteSlug"]}_auth_csrf`,
     /**