Serve HTTPS by default with a local CA

The installer generates a CA and a 397-day certificate into
$COBBLE_HOME/certs (in the app image, with the host's addresses), mounts
the certificate, key and CA into the container and serves TLS from Bun on
the published port. --no-https opts out; --https-cert/--https-key use a
real certificate, --https-host adds names and --https-regen replaces the
CA. The installer and the image health check use curl -k when TLS is on.

The CA is served at /ca.crt and as an iOS/macOS profile at
/ca.mobileconfig for one-tap install. Development picks up certs/
automatically, `bun run dev:phone` generates and starts, and a plain-HTTP
listener on PORT + 1 redirects to HTTPS. Port sharing is off, so a stale
dev server fails instead of silently answering on the same port.

src/data/app-data.ts

@@ -12,6 +12,16 @@ export const AppData = {
      */
     ComposerDraftStorageKey: `${SiteData["SiteSlug"]}_composer_draft`,
     ServerHealthMessage: "Server Running Well",
+    /**
+     * Where a device downloads the local CA that signed the app's
+     * certificate, so it can trust it (`serveLocalCa`): the certificate
+     * and an iOS/macOS profile that installs it, and the names they
+     * download as. Only served with TLS and `TLS_CA_FILE`.
+     */
+    TlsCaPath: "/ca.crt",
+    TlsCaFilename: `${SiteData["SiteSlug"]}-ca.crt`,
+    TlsCaProfilePath: "/ca.mobileconfig",
+    TlsCaProfileFilename: `${SiteData["SiteSlug"]}-ca.mobileconfig`,
     AuthKeyCookieName: `${SiteData["SiteSlug"]}_auth_key`,
     AuthCSRFCookieName: `${SiteData["SiteSlug"]}_auth_csrf`,
     AuthExpiryDays: 60,