Add optional TLS support for secure LAN access

[selfcontained]

Summary

• Adds native HTTPS support to the Fastify server, enabled via TLS_CERT and TLS_KEY environment variables
• When neither is set, the server starts on plain HTTP (no change for dev)
• Updates all bin scripts (dispatch-deploy, dispatch-event, dispatch-stream, dispatch-share, dispatch-release, dispatch-server) to auto-detect HTTP/HTTPS and accept self-signed certs
• Passes DISPATCH_SCHEME env var to agent subprocesses so bin scripts know which protocol to use

Setup

brew install mkcert
mkcert -install
mkdir -p ~/.dispatch/tls
mkcert -cert-file ~/.dispatch/tls/cert.pem -key-file ~/.dispatch/tls/key.pem <LAN-IP> localhost 127.0.0.1

Then add to production .env:

TLS_CERT=~/.dispatch/tls/cert.pem
TLS_KEY=~/.dispatch/tls/key.pem

Test plan

• Verify server starts on HTTP when TLS env vars are unset (dev mode)
• Verify server starts on HTTPS when TLS env vars point to valid cert/key
• Verify error is thrown if only one of TLS_CERT/TLS_KEY is set
• Verify deploy health check works with HTTPS enabled
• Verify agent bin scripts (dispatch-event, dispatch-share, etc.) work over HTTPS

🤖 Generated with Claude Code