feat(login): add optional TLS termination support (#11663)

# Which Problems Are Solved

The login container can only serve HTTP. In deployments where a reverse
proxy is not used, operators need the login container to terminate TLS
itself.

Closes #11473

# How the Problems Are Solved

The container now supports optional HTTPS via three environment
variables that match the pattern already used by the backend server:
`ZITADEL_TLS_ENABLED`, `ZITADEL_TLS_CERTPATH`, and
`ZITADEL_TLS_KEYPATH`. When `ZITADEL_TLS_ENABLED` is not set or set to
`false`, behavior is identical to before. When set to `true`, the server
reads the provided certificate and key files and serves HTTPS using the
lower-level `getRequestHandlers` API from Next.js.

The Docker healthcheck was updated to probe the correct scheme
automatically based on the same environment variable.

# Additional Changes

Added a dockerized integration test that verifies both HTTP and HTTPS
modes using testcontainers.

# Additional Context

The TLS path uses `getRequestHandlers` from
`next/dist/server/lib/start-server` instead of `startServer` because the
latter rejects self-signed certificates in production mode. This is the
same internal API that `startServer` itself calls.

---------

Co-authored-by: Copilot <[email protected]>

apps/login/Dockerfile

@@ -13,9 +13,10 @@ ENV HOSTNAME="::" \
     NODE_ENV="production" \
     NODE_OPTIONS="--use-openssl-ca" \
     SSL_CERT_FILE="/etc/ssl/certs/ca-certificates.crt" \
-    SSL_CERT_DIR="/etc/ssl/certs"
+    SSL_CERT_DIR="/etc/ssl/certs" \
+    ZITADEL_TLS_ENABLED="false"
 
 # TODO: Check healthy, not ready
 HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
-    CMD ["/bin/sh", "-c", "node /app/healthcheck.js http://localhost:${PORT}/ui/v2/login/healthy"]
+    CMD ["/usr/local/bin/node", "/app/healthcheck.mjs"]
 ENTRYPOINT ["/app/entrypoint.sh", "node", "apps/login/server.js" ]