Trust the local CA on a phone from a QR code

1. LAN mode with --https needs the portless CA on each phone, and getting it there is the slow part: iOS needs a configuration profile and then a separate trust toggle, and Android installs a CA only from Settings.
2. portless trust --device prints a QR code and the CA's SHA-256 fingerprint, and serves the CA certificate, never its key, over plain HTTP on the LAN address at a one-time path for ten minutes.
3. The page offers a .mobileconfig on iOS, a DER certificate on Android and PEM elsewhere, with the steps left for that platform. The profile's UUIDs come from the fingerprint, so installing it again replaces it.
4. The QR code is drawn black on white with ANSI colors, so it scans in light and dark terminal themes. Without color it falls back to uqr's half blocks.
5. Closes #573.

Terminal

Page

Tested

• New tests in device-trust.test.ts. The two privileged proxy tests in cli.test.ts fail on my machine only because a proxy already holds port 443.
• The same files and steps took an Android phone from the QR code to a trusted .local app. This command's page was checked in a browser with iOS and Android user agents. The iOS profile passes plutil -lint but hasn't been installed on a device.