local-setup-env should use HTTPS by default with a self-signed cert #1142

Summary

The e2e test infrastructure already uses HTTPS with a private CA certificate, but make local-setup-env still defaults to plain HTTP. The local dev environment should match the e2e setup and use HTTPS by default with a self-signed certificate.

Motivation

• Closer parity between local dev and CI/e2e environments reduces "works on my machine" surprises
• TLS-related bugs (like the hairpin init path) are only caught if the local setup exercises HTTPS
• Developers testing AuthPolicy, OAuth, or URL elicitation flows locally benefit from realistic TLS

Acceptance Criteria

• make local-setup-env provisions a self-signed CA and TLS certificate for the gateway
• The gateway listener defaults to HTTPS
• The MCP endpoint URL printed at the end uses https://
• Existing make local-setup-env users can still override to HTTP if needed