fix(gate-b): restore TLS for slab.local with file-based certs

- Caddyfile: switch from :80 catch-all to slab.local with file-based TLS
  using self-signed cert from deploy/certs/
- docker-compose.yml: publish 443, mount certs volume read-only
- INVENTORY.md: update smoke section with HTTPS results, note phone CA TBD

Host fix: added slab.local → 192.168.1.202 to /etc/hosts,
Caddy now serves HTTPS with HTTP→HTTPS redirect,
curl -k https://slab.local/api/health returns 200 ok.

deploy/Caddyfile

@@ -1,10 +1,9 @@
-# Interim HTTP-only Caddy config for Gate B UAT.
-# Serves frontend + API over plain HTTP on all hostnames/IPs.
-# No TLS, no HTTPS redirect. Phone CA trust is not required.
-#
-# Post-POC: restore slab.local with proper TLS and ACME.
+# Caddy config for slab.local with file-based TLS.
+# Uses pre-generated self-signed certs from certs/ directory.
+# Caddy's internal CA is NOT used; file-based certs avoid CA trust setup.
 
-:80 {
+slab.local {
+	tls /etc/caddy/certs/slab.crt /etc/caddy/certs/slab.key
 	handle /api/* {
 		reverse_proxy fastapi:8000
 	}