Serve plain HTTP only and drop the local certificate tooling

The app never terminates TLS: a reverse proxy or tunnel does, and
isSecureRequest still reads X-Forwarded-Proto so cookies stay Secure.
Removes the cert generator, TLS resolution and HTTP redirect, the
local CA download, and the TLS envs, and trims the installer, Dockerfile
health check and docs to match. Also softens the composer's loading row.

src/dict/env-dict.ts

@@ -37,10 +37,9 @@ export type KnownEnv = {
  * their own keys beside these for bots and computers to use.
  *
  * Not here, and never in the `envs` table: `ENCRYPTION_KEY` and
- * `ENCRYPTION_SALT` (they encrypt the table), and `PORT`, `DATA_DIR`,
- * `MAIN_SERVER`, `TLS_DISABLED`, `HTTP_REDIRECT_PORT` and the `TLS_*`
- * certificate paths (the container's own start-up settings). Those stay in
- * the process environment.
+ * `ENCRYPTION_SALT` (they encrypt the table), and `PORT`, `DATA_DIR` and
+ * `MAIN_SERVER` (the container's own start-up settings). Those stay in the
+ * process environment.
  */
 export const EnvDict: readonly KnownEnv[] = [
     {
@@ -87,11 +86,6 @@ export const ProcessOnlyEnvKeys = [
     "DATA_DIR",
     "DB_DIR",
     "MAIN_SERVER",
-    "TLS_CERT_FILE",
-    "TLS_KEY_FILE",
-    "TLS_CA_FILE",
-    "TLS_DISABLED",
-    "HTTP_REDIRECT_PORT",
 ] as const;
 
 /**

src/dict/help-dict.ts

@@ -9,6 +9,6 @@ export const HelpPath = "/admin/help";
 export const HelpSignInTopicId = "sign-in-with-cookies";
 
 /**
- * Trusting the local HTTPS certificate on a device.
+ * Reaching the app over HTTPS through a proxy or tunnel.
  */
-export const HelpHttpsTopicId = "https-certificate";
+export const HelpSecureConnectionTopicId = "secure-connection";