Play Framework

feat: add play enable-https / disable-https CLI commands (release 1.12.20)

PF-67: getting HTTPS working in dev currently requires the operator to
manually generate a JKS keystore with keytool, look up the right
config keys in application.conf, and get the format right — a 5-minute
task that becomes a 30-minute task the first time you do it. This
ticket adds two new CLI commands that make HTTPS a one-liner:

  $ play enable-https
  ~ Generated self-signed keystore at conf/certificate.jks
  ~ (RSA 2048, CN=localhost, ..., valid 3650 days)
  ~ HTTPS enabled on port 9443.
  ~ Run play run or play start to apply.

  $ play disable-https
  ~ HTTPS disabled.
  ~ The keystore at conf/certificate.jks is preserved — re-run
    play enable-https to reactivate.

Implementation: framework/pym/play/commands/https.py registers both
commands. Picked up automatically by the existing CommandLoader since
it's a .py file in framework/pym/play/commands/.

enable-https:
- If https.port is already an active line in application.conf, prints
  "HTTPS is already enabled" and exits cleanly (no file changes, exit 0).
- If conf/certificate.jks exists, reuses it and pulls keystore.password
  from application.conf — so a disable→enable cycle preserves the
  existing keystore exactly. If the keystore is present but the
  password isn't recoverable from config, prints clear remediation
  instructions and exits.
- Otherwise generates a fresh keystore via keytool -genkeypair: alias
  play, RSA 2048, dname CN=localhost+OU=Development+O=Play+L=Local+
  ST=Local+C=US, validity 3650 days, password from
  secrets.token_urlsafe(16) (Python stdlib, ~22 chars URL-safe base64).
- Sets keystore.algorithm=JKS, keystore.file=conf/certificate.jks,
  keystore.password=<pw>, https.port=9443 in application.conf via a
  match-and-replace helper that uncomments existing skeleton-style
  commented lines (resources/application-skel/conf/application.conf
  already ships with keystore.* lines pre-commented at 267-269).

disable-https:
- If https.port is not active, prints "HTTPS is already disabled".
- Otherwise comments out only the https.port line. Leaves keystore.*
  lines intact so re-enable can pick up the same password without
  prompting; leaves the keystore file on disk so re-enable reuses it.

Idempotence: tested 3x enable + 2x disable alternating. Final
application.conf state has a single active https.port=9443 line, no
duplicates, no stale commented-out entries. Keystore mtime unchanged
across all five invocations.

End-to-end verified on a fresh app:
- play new pf67test && cd pf67test
- play enable-https → keystore generated, opens with stored password
  via keytool -list (round-trip confirmed)
- play disable-https → https.port commented, keystore + keystore.*
  lines preserved
- play enable-https → reuses existing keystore (mtime unchanged)
- play enable-https when already enabled → no-op message, exit 0
- play disable-https when already disabled → no-op message, exit 0

Out of scope (per ticket): Let's Encrypt / ACME, HTTPS-only mode with
HSTS, custom keystore paths via flag, HTTP/2 / HTTP/3 enable commands.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>