Serve HTTPS by default with a local CA

The installer generates a CA and a 397-day certificate into
$COBBLE_HOME/certs (in the app image, with the host's addresses), mounts
the certificate, key and CA into the container and serves TLS from Bun on
the published port. --no-https opts out; --https-cert/--https-key use a
real certificate, --https-host adds names and --https-regen replaces the
CA. The installer and the image health check use curl -k when TLS is on.

The CA is served at /ca.crt and as an iOS/macOS profile at
/ca.mobileconfig for one-tap install. Development picks up certs/
automatically, `bun run dev:phone` generates and starts, and a plain-HTTP
listener on PORT + 1 redirects to HTTPS. Port sharing is off, so a stale
dev server fails instead of silently answering on the same port.

RELEASING.md

@@ -61,7 +61,11 @@ Before the first public release:
 - [ ] The GHCR package is public.
 - [ ] The first release is installed on the real host and a signup, a chat
       reply, a computer and a routine have been exercised.
-- [ ] DNS and the reverse proxy or tunnel point at the container.
+- [ ] A plain `curl | bash` install ends on `https://`, `/ca.crt`
+      downloads, and a device that trusted the CA installs the app, gets a
+      live chat socket and can turn on notifications.
+- [ ] `--no-https` behind a proxy, and `--https-cert`/`--https-key` with a
+      real certificate, were each tried once.
 
 ## Rollback