docs: add comprehensive TLS/HTTPS deployment guide

Implements Phase 1 of security issue #326 to enable HTTPS deployment
via reverse proxy while native TLS support is being developed.

Documentation includes:
- Architecture overview and security considerations
- nginx configuration (recommended for production)
- Traefik configuration (Docker/Kubernetes)
- Caddy configuration (automatic HTTPS)
- HAProxy configuration
- Certificate management (Let's Encrypt, self-signed, commercial)
- Security best practices (TLS 1.2+, HSTS, cipher suites)
- Testing procedures (SSL Labs, OpenSSL, nmap)
- Troubleshooting guide

Security Impact:
- Enables encrypted API traffic in production
- Protects credentials in transit (API keys, auth tokens)
- Prevents man-in-the-middle attacks
- Satisfies compliance requirements (PCI-DSS, HIPAA, SOC 2)

Best Practices Documented:
- TLS 1.2/1.3 only (no weak protocols)
- Modern cipher suites (ECDHE)
- HSTS with 6-month max-age
- Security headers (X-Frame-Options, CSP, etc.)
- Localhost-only API binding
- Firewall configuration

Reverse Proxy Options:
1. nginx - Production-ready, widely adopted
2. Traefik - Automatic Let's Encrypt, Docker-native
3. Caddy - Zero-config automatic HTTPS
4. HAProxy - High performance load balancing

Until native TLS support is implemented in Phase 2, this reverse
proxy approach is the recommended production deployment pattern.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Author: Flossy