Play Framework

feat: self-contained play bundle + drop enable-https/disable-https

Two cohesive changes:

1. play dist + play bundle redesign
   - `play dist` now produces <rootProject.name>.zip with source tree +
     precompiled classes + frontend SPA (Nuxt build at public/spa/), honors
     .gitignore + .distignore, and preserves POSIX permissions (executable
     bit on shell scripts survives via JDK ZipFileSystem provider).
   - `play bundle` produces <rootProject.name>-bundle.zip that's everything
     dist has *plus* the framework jar + framework/lib + Gradle-resolved
     deps + a `.classpath` + a self-contained `play` runtime launcher.
     Java 25+ is the only runtime dependency on the deploy target.
   - The bundled `play` launcher (framework/gradle-plugin/src/main/resources/
     bundle-play.sh) mirrors the dev-time shim's CLI surface for runtime
     commands (run/start/stop/restart/status/pid/out) plus first-run setup
     (secret). Same flag forms — `--%<id>`, `--http.port=`, `--https.port=`,
     `--pid-file=`, `-Xmx`, `-D`, etc. — but dispatches to a direct java
     exec instead of gradle. Project-level wrappers like jclaw.sh that
     prepend $SCRIPT_DIR to PATH and call `play start --%prod ...` work
     identically against the dev shim and the bundled shim.

2. play enable-https / play disable-https removed
   - HTTPS workflow was opaque (regen-vs-reuse, expired-cert detection,
     mkcert-vs-openssl branching) and added an mkcert/openssl runtime
     dependency on the bundle deploy target. Replaced with documented
     direct invocation:
       mkcert -cert-file certs/host.cert -key-file certs/host.key \
              localhost 127.0.0.1 ::1
     (or the openssl equivalent in production.textile / httpserver.textile).
   - Skel application.conf now ships `https.port=${https.port:-1}` so the
     listener stays off by default and toggles via `-Dhttps.port=9443` on
     the JVM. No more two-state (enabled/disabled) conf-mutation dance.
   - Removed PlayEnableHttpsTask + PlayDisableHttpsTask + their helpers
     (whichOnPath, checkCertValidity, generateMkcert, generateOpenssl) and
     the now-unused setOrUncomment + hasActiveLine top-level helpers.
   - Doc updates: configuration.textile, httpserver.textile,
     production.textile, ch25-CommandLinePlayCommand.textile (en+ja).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>