Add TLS support for control API (health server)

[cbaugus]

Problem

The health server (POST /config, GET /health) runs over plain HTTP. For SaaS deployments where the control plane communicates over the internet, TLS is required.

Requirements

• Add optional TLS support to the hyper health server
• Configured via env vars: TLS_CERT_PATH, TLS_KEY_PATH
• When cert/key are provided, server binds with TLS
• When not provided, falls back to plain HTTP (backwards compatible)

Notes

• In Nomad/K8s internal deployments, TLS termination is often handled by the service mesh (Consul Connect, Istio). This is lower priority than auth.
• Consider using rustls instead of OpenSSL for easier cross-compilation

Acceptance Criteria

• Server supports HTTPS when cert/key env vars are set
• Falls back to HTTP when env vars are unset
• Works with self-signed certs for testing