Showcase: sovereign HTTPS demo server + local CA

serve-demo.mjs serves dist/ (app shell, SPA fallback) and instance/origin/
(signed packages + latest.json) on one HTTPS port; generates /sync-config.json
with the pinned signing-key fingerprint from the published package and offers
/rootCA.pem for phone trust. gen-certs.sh creates a local ECDSA CA + server
cert with SANs for localhost, hotspot 10.42.0.1, and current interface IPs.
No tunnels, no third parties: everything runs on this laptop. npm run
demo:certs / demo:serve.

package.json

@@ -21,6 +21,8 @@
     "preview": "vite preview",
     "package:staging": "vite-node pipeline/run.ts",
     "package:smoke": "vite-node pipeline/run.ts --smoke-only",
+    "demo:certs": "bash scripts/gen-certs.sh",
+    "demo:serve": "node scripts/serve-demo.mjs",
     "ci": "npm run typecheck && npm run lint && npm run format && npm run test && npm run build"
   },
   "devDependencies": {