adb50d971a
- Caddyfile: switch from :80 catch-all to slab.local with file-based TLS using self-signed cert from deploy/certs/ - docker-compose.yml: publish 443, mount certs volume read-only - INVENTORY.md: update smoke section with HTTPS results, note phone CA TBD Host fix: added slab.local → 192.168.1.202 to /etc/hosts, Caddy now serves HTTPS with HTTP→HTTPS redirect, curl -k https://slab.local/api/health returns 200 ok.