Add dev sandbox server and certificate management

[franzwarning]

Introduces a new 'dev serve' command with HTTPS support for local sandboxing, including automatic self-signed certificate generation and platform-specific trust prompts for macOS, Windows, and Linux. Adds dependencies for axum, axum-server, tower, tower-http, rcgen, dialoguer, and mime_guess. Updates README with dev server usage instructions and expands config handling for engine types. Refactors and improves code formatting and error handling in existing modules.

---

Note

Introduces wvdsh dev serve to host builds locally over HTTPS with auto-generated/trusted certs, CORS, and sandbox URL generation; updates config/engine handling and docs.

• Dev Server:
  • Add wvdsh dev serve (Axum + Rustls) to serve upload_dir over HTTPS on a random localhost port.
  • Auto-generate and reuse self-signed certs via rcgen; prompt to trust on macOS (security), Windows (certutil), and Linux (sudo + CA update).
  • Permissive CORS for wavedash.gg and subdomains; serves static files with correct headers and compressed asset handling.
  • Discover HTML entrypoint, fetch engine-specific entrypointParams, and produce a ready-to-click sandbox URL.
• Config & Builds:
  • Introduce EngineKind enum with as_config_key/as_label; update build push to use it.
  • Make keyring_service/keyring_account concrete defaults instead of Option.
• CLI:
  • Wire new dev subcommand in main.rs.
• Docs:
  • Update README.md with dev server usage and behavior.
• Dependencies:
  • Add axum, axum-server, tower, tower-http, rcgen, dialoguer, mime_guess; bump serde.

^{Written by Cursor Bugbot for commit 5188443. This will update automatically on new commits. Configure here.}

[cursor]

Bug: Config Defaults Break Keyring Authentication

Changing keyring_service and keyring_account from Option<String> to String with #[serde(default)] breaks the fallback logic. When a config.toml exists without these fields, serde deserializes them to empty strings instead of None. The keyring_config() function no longer calls unwrap_or_else() to apply defaults, causing authentication to fail with empty strings passed to keyring operations.