feat: optional TLS/HTTPS support via env vars

[IKatsuba]

Refs #10 (left open intentionally for verification).

Adds optional HTTPS support, fully opt-in — when the new env vars are unset the server behaves exactly as before (plain HTTP).

Changes

• src/index.ts: read TLS_CERT_PATH / TLS_KEY_PATH and pass cert/key to Deno.serve. Both must be set together — setting only one exits with a config error. If the files can't be read, the server exits 1 with a clear message instead of an unhandled exception. No new permissions needed (--allow-read was already granted).
• src/tls.test.ts + src/fixtures/tls/: unit test that boots Deno.serve with TLS and hits /health over HTTPS. Fixtures are a proper CA + leaf chain (SAN localhost,127.0.0.1, long-lived) — a single self-signed cert is rejected by rustls as CaUsedAsEndEntity.
• e2e/https.test.ts: curl-based e2e that drives the real src/index.ts process over HTTPS and exercises a full PUT → GET round-trip through the S3 emulator (curl honors --cacert, so it can validate the fixture CA — the path Nx's native client cannot take). Uses a dedicated emulator port (4567) to avoid colliding with the Nx e2e suite.
• .env.example (new): full env template with commented TLS vars.
• README: env vars, an HTTPS/TLS section, and a Docker example mounting certs.
• Helm chart (opt-in, tls.enabled=false by default): mounts cert/key from an existing Secret (e.g. cert-manager kubernetes.io/tls), wires TLS_CERT_PATH/TLS_KEY_PATH, and switches the liveness/readiness probes to scheme: HTTPS (otherwise the pod never goes Ready under TLS). The chart README also documents that cert rotation requires a pod restart (rollout restart / Reloader), since certs are read once at startup.

⚠️ Important finding — certificate trust with Nx

While adding e2e coverage I hit a real constraint worth documenting:

Nx's self-hosted cache client is a native HTTP client that validates against the OS trust store. It does not honor NODE_EXTRA_CA_CERTS or SSL_CERT_FILE. A bare self-signed cert is rejected with error sending request (the request never reaches the server). A cert trusted at the OS level (public/corporate CA, or CA installed in the system trust store) works fine.

Because this can't be made portably green in CI (the only cert we can self-generate is self-signed, which Nx won't trust without OS-level install), the Nx-driven HTTPS e2e variant was dropped and the constraint is documented in the README instead. Server-side HTTPS behavior is still covered end-to-end by the curl-based e2e above and the TLS unit test.

Verification

• deno lint + deno fmt --check — clean
• deno task test — passes, incl. the new TLS unit test
• deno task e2e — passes, incl. the curl-based HTTPS round-trip
• Misconfig paths: only one TLS var set → exit 1; unreadable cert/key → exit 1 with a clear message; plain HTTP to the TLS port is rejected
• helm lint + helm template: default → no TLS artifacts; tls.enabled=true --set tls.secretName=… → volume/env/scheme: HTTPS rendered; tls.enabled=true without secretName → fails with a required error
• Manual: curl --cacert ca.pem https://localhost:.../health → OK