Serve HTTPS by default with a local CA

The installer generates a CA and a 397-day certificate into
$COBBLE_HOME/certs (in the app image, with the host's addresses), mounts
the certificate, key and CA into the container and serves TLS from Bun on
the published port. --no-https opts out; --https-cert/--https-key use a
real certificate, --https-host adds names and --https-regen replaces the
CA. The installer and the image health check use curl -k when TLS is on.

The CA is served at /ca.crt and as an iOS/macOS profile at
/ca.mobileconfig for one-tap install. Development picks up certs/
automatically, `bun run dev:phone` generates and starts, and a plain-HTTP
listener on PORT + 1 redirects to HTTPS. Port sharing is off, so a stale
dev server fails instead of silently answering on the same port.

src/dict/env-dict.ts

@@ -37,9 +37,9 @@ export type KnownEnv = {
  * their own keys beside these for bots and computers to use.
  *
  * Not here, and never in the `envs` table: `ENCRYPTION_KEY` and
- * `ENCRYPTION_SALT` (they encrypt the table), and `PORT`, `DATA_DIR` and
- * `MAIN_SERVER` (read before the database opens). Those stay in the
- * process environment.
+ * `ENCRYPTION_SALT` (they encrypt the table), and `PORT`, `DATA_DIR`,
+ * `MAIN_SERVER` and the `TLS_*` certificate paths (the container's own
+ * start-up settings). Those stay in the process environment.
  */
 export const EnvDict: readonly KnownEnv[] = [
     {
@@ -86,6 +86,9 @@ export const ProcessOnlyEnvKeys = [
     "DATA_DIR",
     "DB_DIR",
     "MAIN_SERVER",
+    "TLS_CERT_FILE",
+    "TLS_KEY_FILE",
+    "TLS_CA_FILE",
 ] as const;
 
 /**

src/dict/help-dict.ts

@@ -7,3 +7,8 @@ export const HelpPath = "/admin/help";
  * Signing in to Google and other strict sites with Cookie-Editor.
  */
 export const HelpSignInTopicId = "sign-in-with-cookies";
+
+/**
+ * Trusting the local HTTPS certificate on a device.
+ */
+export const HelpHttpsTopicId = "https-certificate";