feat: add HTTPS/TLS server support via rustls

Add optional TLS support for the server using axum-server with the
tls-rustls feature. When --server-cert and --server-key are provided
(and tls feature is enabled), the server binds with TLS instead of
plain HTTP.

Changes:
- Add axum-server dependency with optional tls-rustls feature
- New 'tls' feature flag (independent of 'server')
- --server-cert/--server-key CLI args gated behind tls feature
- ServerConfig extended with cert_file/key_file fields
- Conditional TLS/HTTP binding in server mod.rs
- Fix PathBuf::to_str().unwrap() panic risk -> to_string_lossy()
- Update README.md and DESIGN.md with TLS documentation

Cargo.toml

@@ -72,6 +72,7 @@ dirs = "6.0.0"
 similar = { version = "2.7.0", default-features = false, features = ["text"] }
 ureq = { version = "3", features = ["json"], optional = true }
 os_pipe = { version = "1", optional = true }
+axum-server = { version = "0.8", features = ["tls-rustls"], optional = true }
 
 [features]
 # Default features include core compression engines and swagger UI
@@ -107,6 +108,9 @@ swagger = ["dep:utoipa-swagger-ui"]
 # Client feature (HTTP client for remote server)
 client = ["dep:ureq", "dep:os_pipe"]
 
+# TLS feature (HTTPS server support)
+tls = ["dep:axum-server"]
+
 [dev-dependencies]
 tempfile = "3.3.0"
 rand = "0.8.5"