Play Framework

refactor: move HTTPS PEM cert defaults from conf/ to certs/ (PF-69, release 1.12.21)

PF-68 made enable-https generate PEM at conf/host.{cert,key}. That clashed
with the jclaw Docker compose stack (which mounts ./certs/ as a dedicated
bind volume) and the ./jclaw.sh cert helper, forcing a runtime entrypoint
symlink to paper over the path mismatch.

PF-69 makes certs/ the single canonical PEM location across every code
path: dev mode (play enable-https), the Java SslContext defaults read by
SslHttpServerPipelineFactory + Http3SslContextFactory, the skeleton
application.conf, the integration testapp fixture, and all documentation.

Scope:
- framework/pym/play/commands/https.py: CERT_PATH/KEY_PATH constants
- framework/src/play/server/ssl/SslHttpServerPipelineFactory.java: getProperty defaults + javadoc
- framework/src/play/server/quic/Http3SslContextFactory.java: getProperty defaults
- resources/application-skel/conf/application.conf: skeleton commented lines
- framework/test-src/integration/testapp/{conf -> certs}/host.{cert,key}: fixture relocated via git mv
- framework/test-src/integration/testapp/conf/application.conf: %test.certificate.* paths
- framework/test-src/integration/Http3FunctionalTest.java: javadoc reference
- framework/test-src/play/server/ssl/SslHttpServerPipelineFactoryAlpnTest.java: test paths
- documentation/{commands,manual}: cmd-{enable,disable}-https.txt, configuration.textile, production.textile

Verified end-to-end on a fresh app: enable-https generates certs/host.{cert,key}
(conf/host.* never created), application.conf has certs/ paths active, server
binds TCP 9000 + TCP 9443 + UDP 9443, ALPN h2 negotiates, mkcert PEM at
certs/host.cert is loaded by Netty. disable-https comments https.port and
preserves certs/. Re-enable reuses without regenerating. Unit + Http2/Http3
integration tests pass against the new fixture location.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>