Serve HTTPS by default with a local CA

The installer generates a CA and a 397-day certificate into
$COBBLE_HOME/certs (in the app image, with the host's addresses), mounts
the certificate, key and CA into the container and serves TLS from Bun on
the published port. --no-https opts out; --https-cert/--https-key use a
real certificate, --https-host adds names and --https-regen replaces the
CA. The installer and the image health check use curl -k when TLS is on.

The CA is served at /ca.crt and as an iOS/macOS profile at
/ca.mobileconfig for one-tap install. Development picks up certs/
automatically, `bun run dev:phone` generates and starts, and a plain-HTTP
listener on PORT + 1 redirects to HTTPS. Port sharing is off, so a stale
dev server fails instead of silently answering on the same port.

.env.example

@@ -17,6 +17,15 @@ DEV_EMAIL_RECIPIENT=
 ENCRYPTION_KEY=
 ENCRYPTION_SALT=
 
+# HTTPS (optional in development; see README). Generate files with
+# `bun run gen:certs` and point these at them. The installer sets them on a
+# real install. Leave all three empty to serve plain HTTP.
+TLS_CERT_FILE=
+TLS_KEY_FILE=
+TLS_CA_FILE=
+# Plain-HTTP port that redirects to the HTTPS one (default PORT + 1).
+DEV_HTTP_PORT=
+
 # Web Push: generated into Settings > Environment on first start. Set a
 # fixed pair here only if you want to keep one across installs.
 VAPID_PUBLIC_KEY=