Serve HTTPS by default with a local CA

The installer generates a CA and a 397-day certificate into
$COBBLE_HOME/certs (in the app image, with the host's addresses), mounts
the certificate, key and CA into the container and serves TLS from Bun on
the published port. --no-https opts out; --https-cert/--https-key use a
real certificate, --https-host adds names and --https-regen replaces the
CA. The installer and the image health check use curl -k when TLS is on.

The CA is served at /ca.crt and as an iOS/macOS profile at
/ca.mobileconfig for one-tap install. Development picks up certs/
automatically, `bun run dev:phone` generates and starts, and a plain-HTTP
listener on PORT + 1 redirects to HTTPS. Port sharing is off, so a stale
dev server fails instead of silently answering on the same port.

package.json

@@ -5,7 +5,9 @@
     "private": true,
     "scripts": {
         "dev": "bun src/server.ts",
+        "dev:phone": "bun src/scripts/dev-phone.ts",
         "gen:favicon": "bun src/scripts/generate-brand-assets.ts",
+        "gen:certs": "bun src/scripts/generate-local-certs.ts",
         "build": "bunx bunext build",
         "db:schema": "bunx bun-sqlite schema -t",
         "db:admin": "bunx bun-sqlite admin",