Add TLS/HTTPS support with Let's Encrypt and BYO certificates

[patrickdappollonio]

Summary

Adds native HTTPS support to http-server in two modes:

Automatic certificates (Let's Encrypt): pass --hostname example.com and a free TLS certificate is provisioned automatically via certmagic. Handles HTTP-01 challenges, automatic renewal, and filesystem-based certificate storage.

Bring your own certificate: pass --tls-cert and --tls-key with your own cert and key files.

Both modes include:

• Dual listeners: HTTPS serves content, HTTP redirects to HTTPS (and handles ACME challenges in auto mode)
• Certificate reload: swap certs without downtime via SIGHUP (Unix) or POST /_/tls/reload
• Certificate metadata: GET /_/tls returns JSON with subject, SANs, issuer, and expiry
• File hiding: cert/key files and the certmagic cache directory are hidden from listings and blocked from direct access
• Grouped --help: all CLI flags organized into logical sections

New flags

Flag	Default	Description
--hostname	—	Domain name. Alone = auto-cert from Let's Encrypt. With --tls-cert/--tls-key = BYO cert.
--tls-cert	—	Path to TLS certificate file (PEM, BYO mode)
--tls-key	—	Path to TLS private key file (PEM, BYO mode)
--tls-email	—	Email for Let's Encrypt notifications (auto mode)
--tls-cache-dir	.certmagic/ in served dir	Certificate storage directory (auto mode)
--https-port	443	HTTPS listener port
--http-port	80	HTTP listener port (use 0 to disable in BYO mode)

Usage

# Automatic certificate from Let's Encrypt
http-server --hostname example.com -d ./site

# With email notifications and custom cert storage
http-server --hostname example.com --tls-email you@example.com --tls-cache-dir /data/certs -d ./site

# BYO certificate
http-server --tls-cert cert.pem --tls-key key.pem --hostname example.com -d ./site

# Non-privileged ports
http-server --hostname example.com --https-port 8443 --http-port 8080 -d ./site

Multi-instance / Kubernetes

Certificates are stored on the filesystem (default .certmagic/ in the served directory). Multiple instances sharing the same volume reuse the same certificates. certmagic uses file locking to prevent ACME races. Use --tls-cache-dir to point at a shared persistent volume.

Cache directory hiding is scoped to the active auto-TLS cache path only. Users serving .certmagic directories without auto-TLS are not affected.

Closes

• Closes Let's Encrypt HTTPS support #145
• Closes Support for BYO certificate + key #146

Test plan

• 36 test cases covering TLS types, cert loading, expiry detection, validation rules (BYO + auto mode detection + port conflicts), reload behavior, endpoint responses, file hiding, and path prefix blocking
• All existing tests pass unchanged
• golangci-lint clean