Play Framework

fix: enable-https preserves user-customized https.port + keystore.* values (release 1.12.20)

PF-67 follow-up: enable-https previously had asymmetric behavior. It
correctly preserved a user's custom http.port=8080 but unconditionally
overwrote https.port, keystore.file, keystore.algorithm, and
keystore.password — meaning a user with https.port=8443 (custom port),
keystore.file=conf/my-cert.jks (custom path), or keystore.algorithm=
PKCS12 (custom format) would silently lose those values on every
enable-https invocation.

Fix: apply the symmetric "comment/uncomment-only" contract uniformly.
Each line is set to the framework default ONLY when no active line
exists; an active line is left alone regardless of value. Same pattern
that was already in place for http.port.

Keystore-path preservation is the bigger of the two fixes:

- Resolves keystore.file from the active config (or KEYSTORE_PATH
  default) up front, then uses that path everywhere — the existence
  check, keystore generation, password extraction, and status
  messages. A user with keystore.file=conf/my-cert.jks now has THAT
  path checked / generated / referenced, not the framework default.

- Detects keystore.algorithm asymmetrically: if user has set a
  non-JKS algorithm AND the keystore doesn't exist, the command
  refuses cleanly rather than silently producing a JKS file at a
  path the user expected to hold (e.g.) PKCS12. Error message tells
  the user to generate the keystore manually with the right -storetype
  and re-run.

- Honors a pre-set keystore.password during initial generation: a
  user who declared keystore.password=mysecret before running
  enable-https gets a keystore created with THAT password instead
  of having it overwritten with a fresh random one.

play.http2.enabled stays unconditional — it's the feature toggle the
command exists to flip, not a configuration value.

End-to-end verified across six scenarios: fresh defaults; custom
http.port=8080; custom https.port=8443; http.port=-1 (HTTPS-only);
custom keystore.file with pre-existing keystore; non-JKS algorithm
with no keystore (error path).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>