fix: cap peer browse, containerise the cert section, serve LAN HTTPS

content.browse-all-peers had a per-peer timeout but no OVERALL budget. On this
node that meant >45s with no answer, which the assistant reported to the
operator as "having trouble accessing the peer content list". Measured cause:
16 federated peers, 1 reachable. Now bounded to 20s total, returning partial
results with peers_reached / peers_total / peers_unreachable / partial, so the
assistant can say "1 of 16 peers answered" instead of implying the rest have
nothing. Verified on the node: 20.015s, was >45s.

NodeCertificateSection had no container — I copied a section that sits INSIDE a
card rather than one that provides its own. Now uses the same
`glass-card px-6 py-6 mb-6` shell and heading level as every other settings
section, so it matches on desktop and mobile.

setup-node-ca.sh now also ensures the nginx HTTPS listener, because a CA is
useless if nothing serves TLS. It binds LAN addresses ONLY: tailscaled already
owns :443 on the tailnet addresses with its own Let's Encrypt cert, so a plain
`listen 443 default_server` binds 0.0.0.0 and fails EADDRINUSE — and nginx then
keeps running the OLD config while the reload reports success. Hit exactly that
on archi-dev-box. Port 80 keeps serving: nodes are reached by IP on LANs where
forcing a redirect would strand anyone who has not installed the CA.

Live now: https://192.168.63.240/ and https://<host>.local/ both 200 with
verify=0 against the node CA, http still 200, tailscaled's 443 untouched.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

neode-ui/src/views/settings/NodeCertificateSection.vue

@@ -52,9 +52,12 @@ onMounted(async () => {
 </script>
 
 <template>
-  <div class="mb-6">
-    <h3 class="text-base font-medium text-white/90 mb-1">Node certificate</h3>
-    <p class="text-sm text-white/60 mb-4">
+  <!-- Node Certificate Section -->
+  <div class="glass-card px-6 py-6 mb-6">
+    <div class="mb-2">
+      <h2 class="text-xl font-semibold text-white/96">Node certificate</h2>
+    </div>
+    <p class="text-sm text-white/60 mb-6">
       Install this node's certificate on a device and it stops warning you about
       this node — on every port, not just the dashboard. Apps that open inside
       the dashboard need this: a certificate warning cannot be accepted inside an