Add automated TLS enrollment workflow

[mendacus]

Adds a workflow for automatic Let’s Encrypt enrollment inside Dispatch, plus documentation so operators understand how to use it.

1. dispatch/config.py – introduces explicit certbot directories/ACME endpoints, ensures challenge paths exist, and exposes staging vs production URLs.
2. dispatch/db.py – extends the settings table (with migrations) to persist certificate metadata and UI options.
3. dispatch/certs.py – wraps certbot calls with install helpers, ACME server selection, lineage cleanup, metadata logging, and HTTP-01 file handling.
4. dispatch/app.py – surfaces cert settings in the UI, handles install/enroll actions, hosts /.well-known/acme-challenge/, and logs errors.
5. dispatch/templates/settings/settings.html – new TLS enrollment card with domain/email/staging controls and install/request buttons.
6. dispatch-server.py – logs certificate details when loading the HTTPS context.
7. README.md – documents the workflow (port checks, HTTP mode, staging vs production, restarting on 443).

This lets Dispatch operators install certbot from the UI, request staging or production certs, and have the service automatically copy the resulting cert/key into dispatch/data/certs/.