Item 8: Enforce TLS by default for daemon communication

[mark-e-deyoung]

Currently TLS is fully optional in wbabd serve — if WBABD_TLS_CERT_FILE and WBABD_TLS_KEY_FILE are not set, the daemon starts with plain HTTP.

Change: Require TLS by default. Add WBABD_TLS_DISABLE=1 as explicit opt-out for development.

Scope:

• tools/wbabd: serve handler fails if no TLS configured and WBABD_TLS_DISABLE is not set
• scripts/security/daemon-preflight.sh: validate_tls() respects WBABD_TLS_DISABLE
• tests/shell/test_wbabd_serve_tls_limits_config.sh: Test that plain-HTTP serve is rejected by default, allowed with opt-out
• tests/policy/daemon_security.sh: Updated to verify WBABD_TLS_DISABLE handling
• docs/CONTRACTS.md: Update TLS contract
• docs/DAEMON_API_SECURITY_PLAN.md: Update security plan