feat(server): serve directly over https

new config options key_path, cert_path

this eases local development against firefox, which requires
everything over https.