fix(gate-b): IP-based TLS — :443 catch-all + IP SANs on cert

- Caddyfile: switch slab.local site block to :443 catch-all so
  any SNI (IP or hostname) reaches the reverse proxy. Bare IP
  HTTPS no longer fails with SSL_ERROR_INTERNAL_ERROR_ALERT.
- Cert: regenerate self-signed cert with SANs: DNS:slab.local,
  IP:192.168.1.202, IP:100.64.0.9. IP SANs ensure cert is presented
  for IP-based connections; :443 catch-all ensures Caddy routes
  the request regardless of SNI.
- INVENTORY.md: document IP SANs, :443 catch-all, phone access
  steps, and bare-IP test results.

Verified on ubuDual5060:
- curl -sk https://192.168.1.202/api/health → 200 ok
- curl -sk https://192.168.1.202/ → 200, frontend HTML
- curl -sk https://100.64.0.9/api/health → 200 ok
- curl -skI http://192.168.1.202/ → 308 redirect to HTTPS
- openssl s_client to 192.168.1.202:443 → TLS 1.3 handshake OK

deploy/Caddyfile

@@ -1,8 +1,9 @@
 # Caddy config for slab.local with file-based TLS.
 # Uses pre-generated self-signed certs from certs/ directory.
 # Caddy's internal CA is NOT used; file-based certs avoid CA trust setup.
+# :443 catch-all ensures IP-based SNI does not fail; slab.local is the primary name.
 
-slab.local {
+:443 {
 	tls /etc/caddy/certs/slab.crt /etc/caddy/certs/slab.key
 	handle /api/* {
 		reverse_proxy fastapi:8000