E1: Optional built-in HTTPS / TLS

[LarsLaskowski]

Epic: Cross-cutting / smaller items

Suggested extra label: security.

Why

README / SECURITY.md assume a reverse proxy terminates TLS. For a simple single-Pi setup, users should be able to serve HTTPS directly without standing up nginx/Caddy.

Scope

Optional tls_cert / tls_key config; when both are set, start the server with the std-lib (*http.Server).ListenAndServeTLS instead of plain ListenAndServe. Plain HTTP stays the default.

Reuse & touch points

• internal/httpapi/server.go — ListenAndServe (~line 101) and the http.Server built around line 84.
• cmd/pimonitor/main.go — server startup (~line 85).
• internal/config/config.go — new tls_cert / tls_key keys.
• Document in packaging/pimonitor.example.yaml.

API & config impact

Config keys only; no API shape change.

Acceptance criteria

• With cert/key configured, the server answers over https://.
• A config test covers the branches: both set → TLS, neither set → plain HTTP, only one set → error.