Use a local-only default while preserving saved operator choices and keeping broader network access available from the settings panel.
Treat enabled encrypted transport as a startup requirement and present a dismissible notice when remote browser access is not protected.
initWebUI now takes { host, tlsEnabled }. When TLS is enabled, load+validate
config/cert.pem + key.pem (tls.ts: validateTlsPair / resolveTlsContext, both
unit-tested) and serve via @hono/node-server's https createServer; a missing
or invalid cert falls back to HTTP with a loud warning (never bricks the WebUI).
Bind host is now configurable (default 0.0.0.0). Wired from runtime.json
(webuiHost / webuiTls.enabled) in core/index.ts.
DrSmoothl