feat(hub): load main listener TLS from a certificate directory (--tls-dir)

[gmpassos]

Summary

Adds --tls-dir to hub start / service install hub: the main wss listener can load its certificate from a directory holding fullchain.pem + privkey.pem (the Let's Encrypt layout), as a mutually-exclusive alternative to --cert/--key.

On renewal the Hub rebinds the listener on the same port (shared: true) with the freshly-loaded context, so the new certificate is served without a restart — established connections drain on the old listener while new ones land on the renewed cert.

When --tls-dir is set it also drives sensible tunnel defaults:

• --tunnel-tls-dir defaults to the same directory (secure tunnels reuse the cert, hot-reloaded the same way).
• --tunnel-public-host defaults to the certificate's DNS name (its SAN, falling back to the subject CN). This derivation applies in --cert/--key mode too.

Changes

• Generalize TunnelTlsSource → reusable PemTlsSource (adds a log label), used for both the main listener and tunnel ports.
• New CertificateNames.primaryDnsName — derives the public host from the leaf cert's SAN/CN (hand-rolled DER walk, in the existing spki.dart style).
• HubConfig: nullable securityContext + tlsDirectory/tlsReloadInterval (asserts exactly one TLS source); OmnyShellHub rebinds on reload.
• WsServerEndpoint.bind gains a shared flag for gap-free rebind.
• README + CLI help updated for --tls-dir and the derived tunnel defaults.

Tests

• New certificate_names unit test; renamed pem_tls_source reload tests.
• CLI dry-run/validation tests (rendering, mutual exclusion, missing pems).
• Integration test covering serve-over-wss-from-directory and the full renewal → rebind → reconnect cycle.
• Full suite: 478 passing; dart analyze clean; dart format applied.

🤖 Generated with Claude Code