fix(web): default mgmt proxy to the HTTPS self-signed mgmt API

The mgmt API serves HTTPS with the host's self-signed identity cert and requires
mTLS-or-bearer auth (the mTLS work), but the web console's proxy still defaulted to
`http://127.0.0.1:47990` — so a deployment copying .env.example got a plain-HTTP
request to an HTTPS port (→ 502 Bad Gateway, observed live on the Bazzite box).

- .env.example + server/util/auth.ts + vite.config.ts: default PUNKTFUNK_MGMT_URL to
  https://127.0.0.1:47990.
- vite dev proxy: `secure: false` (the host cert is self-signed).
- Document that the deployment needs PUNKTFUNK_MGMT_TOKEN (matching the host's) and
  NODE_TLS_REJECT_UNAUTHORIZED=0 — the web server's only outbound TLS is the loopback
  hop to the host's own self-signed cert, so disabling verify there is scoped + safe.

The running Bazzite box is already fixed live (web.env → https + token + cert-skip,
verified: login 200, /api/v1/status 200). This makes fresh deployments correct.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

web/.env.example

@@ -6,14 +6,21 @@
 # never admits anyone by accident.
 PUNKTFUNK_UI_PASSWORD=change-me
 
-# Management API the console proxies to. Keep it loopback — it should NOT be LAN-exposed;
-# the login-gated web server is the only path to it.
-PUNKTFUNK_MGMT_URL=http://127.0.0.1:47990
+# Management API the console proxies to. It serves HTTPS (the host's own identity cert) and
+# requires auth (mTLS or the bearer below). Keep this loopback — the login-gated web server is
+# the only path to it.
+PUNKTFUNK_MGMT_URL=https://127.0.0.1:47990
 
-# Bearer token for the management API, injected server-side by the /api proxy (never sent
-# to the browser). Must match the host's `--mgmt-token` / PUNKTFUNK_MGMT_TOKEN.
+# REQUIRED: bearer token for the management API, injected server-side by the /api proxy (never
+# sent to the browser). Must match the host's `--mgmt-token` / PUNKTFUNK_MGMT_TOKEN — otherwise
+# the proxy gets 401.
 PUNKTFUNK_MGMT_TOKEN=
 
+# REQUIRED with the HTTPS mgmt API: the host presents a SELF-SIGNED identity cert on loopback,
+# which the proxy's fetch would otherwise reject (→ 502). The web server makes no other outbound
+# TLS calls, so disabling verification here only affects the loopback hop to the host's own cert.
+NODE_TLS_REJECT_UNAUTHORIZED=0
+
 # OPTIONAL: explicit cookie-sealing secret (>= 32 chars). If unset, a stable key is derived
 # from PUNKTFUNK_UI_PASSWORD (changing the password then invalidates sessions).
 # PUNKTFUNK_UI_SECRET=