Implement TLS certificate generation

[2witstudios]

Epic 2: Server Foundation — Issue 3/5

Source: serve-auth worktree (wt-ovqrfu)

Description

Self-signed TLS certificate generation for HTTPS serving with LAN IP SANs, no external crypto dependencies.

Acceptance Criteria

• Self-signed CA: 10-year validity, reusable across restarts
• Server cert: 1-year validity, signed by CA
• LAN IP detection via os.networkInterfaces() for Subject Alternative Names
• Cert reuse when not expired and SANs still match
• No external crypto dependencies (hand-coded ASN.1/DER using Node.js crypto)
• CA fingerprint for pairing URL
• Pairing URL scheme: ppg://connect?host=...&port=...&ca=...&token=...
• Certs stored in .ppg/serve/tls/ with proper permissions
• Tests: cert generation, CA properties, SANs, validity, persistence/reuse

Files to Create/Modify

• src/server/tls.ts (new)
• src/server/tls.test.ts (new)