Terminates HTTPS on port 443 with self-signed cert, redirects :80 to HTTPS. Required for Payload admin CSRF (browsers only send Sec-Fetch-Site in secure context). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>