proxy-v2.0.2 — TLS dev-certificate constraint fix

Security-relevant fix: TLS dev certificate was not properly constrained

Summary for security review: the local development TLS certificate generated by proxy/scripts/setup.ps1 -DevCert (and the manual openssl command previously documented in proxy/README.md) was a self-signed certificate with basicConstraints: CA:TRUE and no keyUsage/extendedKeyUsage restriction. In X.509 terms, the certificate the proxy presented for TLS was itself flagged as a valid Certification Authority rather than a constrained end-entity certificate scoped to serving TLS for one hostname.

• Scope: local development certificate generation only. This is not the certificate used for QPS mutual-TLS authentication (QLIK_CERT/QLIK_KEY, unaffected), and it never leaves the local certs/ directory (git-ignored, never committed).
• Why it wasn't caught sooner: Windows CryptoAPI and Chrome accept a CA-flagged certificate for TLS without complaint. Firefox's strict path-building validator (mozilla::pkix) correctly rejects it (MOZILLA_PKIX_ERROR_CA_CERT_USED_AS_END_ENTITY), which is how this was caught during a deployment.
• Fix: certificate generation is now a proper two-tier setup:
  1. A dedicated local development CA (certs/ca/, generated once per checkout, basicConstraints=critical,CA:TRUE,pathlen:0) — unrelated to and independent of any CA used elsewhere in a customer's Qlik or corporate PKI.
  2. A constrained end-entity leaf certificate signed by that CA (basicConstraints=critical,CA:FALSE, keyUsage=critical,digitalSignature,keyEncipherment, extendedKeyUsage=serverAuth) — usable only to serve TLS for the proxy's configured hostname(s), not to sign anything else.
• Trust model improvement: -TrustCert now imports only the CA into the OS trust store, never the leaf, so a future certificate rotation or an added hostname never requires re-importing anything into the trust store.
• Key handling: both the CA's and the leaf's private keys are generated locally, never transmitted anywhere, and are git-ignored. The CA key is treated as more sensitive than the leaf's (it alone can mint further certificates) and is isolated in its own certs/ca/ directory.
• Remediation for existing deployments: regenerate the certificate via scripts/setup.ps1 -DevCert -TrustCert. The previous non-conformant certificate never left the local filesystem, so this is a local remediation, not a supply-chain or distribution concern.

Also in this release

• -CertHosts is now a comma-separated string parameter, not a PowerShell array (an array-typed parameter does not reliably survive a pwsh -File invocation from outside PowerShell).
• Documented: npm ci deletes the node-windows service-wrapper dependency (deliberately excluded from package-lock.json), which crashes an already-installed Windows service with Error 1067 on its next restart. Fix: npm install --no-save node-windows, then Restart-Service <name>.

Pairs with extension v0.5.5.

See CHANGELOG.md for full details.