fix(gate-b): restore TLS for slab.local with file-based certs

- Caddyfile: switch from :80 catch-all to slab.local with file-based TLS
  using self-signed cert from deploy/certs/
- docker-compose.yml: publish 443, mount certs volume read-only
- INVENTORY.md: update smoke section with HTTPS results, note phone CA TBD

Host fix: added slab.local → 192.168.1.202 to /etc/hosts,
Caddy now serves HTTPS with HTTP→HTTPS redirect,
curl -k https://slab.local/api/health returns 200 ok.

deploy/docker-compose.yml

@@ -41,8 +41,10 @@ services:
     restart: unless-stopped
     ports:
       - "0.0.0.0:80:80"
+      - "0.0.0.0:443:443"
     volumes:
       - ./Caddyfile:/etc/caddy/Caddyfile
+      - ./certs:/etc/caddy/certs:ro
     depends_on:
       - frontend
       - fastapi