Design for muxplex setup-tls command with auto-detection:
- Tailscale cert (real LE, universally trusted)
- mkcert (local CA, zero browser warnings)
- Self-signed fallback (works but browser warns)
Covers settings integration, CLI flags, service integration,
doctor diagnostics, and error handling edge cases.
Brian Krabach