feat(server): serve HTTP-only on $PORT when TLS terminates at the edge

[jsugg]

What

Introduce a TLS_ENABLED flag so the app can serve HTTP-only on $PORT when TLS is terminated at the platform edge.

• config.https.enabled = process.env.TLS_ENABLED !== 'false' (default on, so local and self-hosted runs keep their HTTPS listener unchanged).
• When disabled, startApplicationRuntime binds only the plain HTTP listener and skips certificate loading and the HTTPS listener entirely — no wasted port, no certificates required.
• Certificates still load before any listener binds, so a TLS failure aborts boot cleanly rather than leaving a half-open HTTP socket.

Why

Behind an edge that terminates TLS and routes plain HTTP to a single injected $PORT, the app's own HTTPS listener is redundant: it needs certificates that are not present in that environment and binds a second port the edge never probes. Setting TLS_ENABLED=false there makes the runtime bind exactly the one HTTP port the platform health-checks.

Tests

• New runtime test: with httpsEnabled: false, only the HTTP server starts, certificates are never loaded, and shutdown registers a single server.
• New config test: TLS_ENABLED=false disables config.https.enabled.
• Existing "starts both servers" and TLS-failure cleanup tests unchanged and passing.