jsonrpc: optional TLS termination (HTTP/2)

[jsonrpc].tls = { cert, key } makes the endpoint terminate TLS itself,
which also enables HTTP/2 (ALPN), so traffic is encrypted right up to
fedserv — for when it runs on a different host from the site, or the
browser's TLS should reach it directly. Absent = plain HTTP for a
reverse-proxy front. Reuses the same cert/key shape as [grpc]; a crypto
provider is pinned before building the config (the tree carries more than
one). Verified the TLS config builds against a real cert without a
provider panic.

src/config.rs

@@ -105,6 +105,10 @@ pub struct JsonRpc {
     // ["https://tchatou.fr", "https://swaygo.fr"]. Empty = no browser access.
     #[serde(default)]
     pub origins: Vec<String>,
+    // Terminate TLS here (enabling HTTP/2). Absent = plain HTTP, for when a
+    // reverse proxy does TLS. Reuses the same cert/key shape as [grpc].
+    #[serde(default)]
+    pub tls: Option<ServerTls>,
 }
 
 #[derive(Debug, Deserialize, Clone)]