Adding multiple options for terminating TLS directly in a forge runtime (#21)

* Adding multiple options for terminating TLS directly in a forge app instead of deferring that to an external application, like a reverse proxy. I personally tend to deploy my load balancers on a separate machine from my application servers and I want end-to-end encryption as part of a zero-trust architecture. You can't get that if your app sends unencrypted traffic even if it's over a private subnet.

* Add optional TLS termination to the gateway

Enable [gateway.tls] with cert_path + key_path in forge.toml to serve
HTTPS directly from the runtime. Both paths set → TLS on; neither set
→ plain HTTP; setting only one is a startup error.

Uses rustls via the tls-listener crate, whose axum feature implements
axum::serve::Listener directly, so the gateway keeps a single
axum::serve hotpath for HTTP and HTTPS. rustls-pemfile parses the
certificate and key; the ring crypto provider is installed once at
startup.

For deployments behind a load balancer or on private subnets, a
throwaway cert is one command:

    openssl req -x509 -newkey rsa:2048 -nodes -days 365 \
      -keyout key.pem -out cert.pem -subj "/CN=app.internal"

Not a public TLS terminator — no HSTS, OCSP stapling, ACME, or hot
reload. Put a load balancer or CDN with a real CA-issued cert in
front for internet-facing deployments.

* TLS PR updates.

* Normalize Dioxus signal API and improve SQL migration parsing

* Normalize Dioxus signal API and improve SQL migration parsing

* Add PeerAddr::ip() method and use it instead of .0.0 field access

* Downgrade forge check strict validation to warning when env vars are unresolved

Author: GoatedChopin