[chore] add npm run certs for the dev https pair

[AlexZ005]

Follow-up to the README correction on release/next (eed29bb): replaces the
pasted openssl invocation with a script.

Why

vite.config.ts reads certs/localhost.crt / certs/localhost.key inside a
try/catch that returns undefined when they are missing, so the dev server
quietly serves plain http instead. WebXR and getUserMedia both require TLS,
so on a fresh clone VR and voice chat fail with no error pointing at the cause.
The pair is gitignored (it holds a private key) - only certs/req.cnf is
committed - so every clone has to generate one.

What

• scripts/gen-certs.cjs - generates the pair from the committed certs/req.cnf
  • idempotent: skips when both files exist, --force overwrites
  • resolves openssl from PATH, then the Git for Windows bundle (openssl is
    normally not on PATH for cmd.exe, which is what npm scripts use on Windows)
  • actionable per-platform message when openssl cannot be found
  • 825 days, the maximum browsers accept for a leaf certificate
• package.json - "certs": "node scripts/gen-certs.cjs"
• README.md - points at npm run certs instead of the raw openssl command

Verified

• all four paths exercised in a scratch copy of the repo layout, not a checkout:
  fresh generate, idempotent re-run, --force, and missing req.cnf (exit 1)
• generated cert checked with openssl x509: CN=localhost,
  subjectAltName = DNS:localhost, DNS:*.localhost, not expired
• prettier --check clean against the repo .prettierrc, so npm run lint stays green
• no source files touched, so the svelte-check baseline is unaffected

Not run: npm run build / npm run e2e. This adds a standalone script plus a
package.json scripts entry and touches nothing the app imports.

Co-Authored-By: Claude Opus 5 (1M context) noreply@anthropic.com