Serve HTTPS by default with a local CA

The installer generates a CA and a 397-day certificate into
$COBBLE_HOME/certs (in the app image, with the host's addresses), mounts
the certificate, key and CA into the container and serves TLS from Bun on
the published port. --no-https opts out; --https-cert/--https-key use a
real certificate, --https-host adds names and --https-regen replaces the
CA. The installer and the image health check use curl -k when TLS is on.

The CA is served at /ca.crt and as an iOS/macOS profile at
/ca.mobileconfig for one-tap install. Development picks up certs/
automatically, `bun run dev:phone` generates and starts, and a plain-HTTP
listener on PORT + 1 redirects to HTTPS. Port sharing is off, so a stale
dev server fails instead of silently answering on the same port.

Dockerfile

@@ -5,8 +5,10 @@ LABEL org.opencontainers.image.title="Cobble" \
       org.opencontainers.image.source="https://github.com/Moduletrace/cobble" \
       org.opencontainers.image.licenses="MIT"
 
+# openssl generates the local CA and certificate the installer serves HTTPS
+# with (`src/scripts/generate-local-certs.ts`).
 RUN apt-get update \
-    && apt-get install -y --no-install-recommends curl bash nano wget zip unzip \
+    && apt-get install -y --no-install-recommends curl bash nano wget zip unzip openssl \
     && rm -rf /var/lib/apt/lists/*
 
 ENV NODE_ENV=production
@@ -31,6 +33,6 @@ COPY entrypoint.sh /entrypoint.sh
 RUN chmod +x /entrypoint.sh
 
 HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
-    CMD curl -fsS "http://localhost:${PORT:-7227}/api/health" || exit 1
+    CMD if [ -n "$TLS_CERT_FILE" ]; then curl -fsSk "https://localhost:${PORT:-7227}/api/health" || exit 1; else curl -fsS "http://localhost:${PORT:-7227}/api/health" || exit 1; fi
 
 ENTRYPOINT ["/entrypoint.sh"]