feat(serve): add TLS support with --tls-cert and --tls-key flags

Adds make cert target for self-signed dev certs and development guide.

Makefile

@@ -2,7 +2,7 @@ BINARY  := nib
 MODULE  := github.com/lerko/nib
 GOFLAGS := -trimpath
 
-.PHONY: build dev watch test lint fmt vet clean run help
+.PHONY: build dev watch test lint fmt vet clean run cert help
 
 ## —— Build ——————————————————————————————————
 
@@ -41,6 +41,14 @@ fmt-check: ## Check formatting (fails if unformatted)
 
 ## —— Utility ————————————————————————————————
 
+cert: ## Generate self-signed dev TLS cert (certs/)
+	@mkdir -p certs
+	openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 \
+		-nodes -keyout certs/dev.key -out certs/dev.crt -days 365 \
+		-subj "/CN=localhost"
+	@echo "  certs/dev.crt and certs/dev.key ready"
+	@echo "  usage: make run ARGS=\"serve --tls-cert certs/dev.crt --tls-key certs/dev.key\""
+
 clean: ## Remove build artifacts
 	rm -f $(BINARY) coverage.out