feat(login): add optional TLS termination support (#11663)

# Which Problems Are Solved

The login container can only serve HTTP. In deployments where a reverse
proxy is not used, operators need the login container to terminate TLS
itself.

Closes #11473

# How the Problems Are Solved

The container now supports optional HTTPS via three environment
variables that match the pattern already used by the backend server:
`ZITADEL_TLS_ENABLED`, `ZITADEL_TLS_CERTPATH`, and
`ZITADEL_TLS_KEYPATH`. When `ZITADEL_TLS_ENABLED` is not set or set to
`false`, behavior is identical to before. When set to `true`, the server
reads the provided certificate and key files and serves HTTPS using the
lower-level `getRequestHandlers` API from Next.js.

The Docker healthcheck was updated to probe the correct scheme
automatically based on the same environment variable.

# Additional Changes

Added a dockerized integration test that verifies both HTTP and HTTPS
modes using testcontainers.

# Additional Context

The TLS path uses `getRequestHandlers` from
`next/dist/server/lib/start-server` instead of `startServer` because the
latter rejects self-signed certificates in production mode. This is the
same internal API that `startServer` itself calls.

---------

Co-authored-by: Copilot <[email protected]>

apps/login/project.json

@@ -131,6 +131,26 @@
         ]
       }
     },
+    "test-ssl": {
+      "description": "Runs TLS integration tests using testcontainers",
+      "dependsOn": [
+        "build"
+      ],
+      "executor": "nx:run-commands",
+      "cache": true,
+      "inputs": [
+        "default",
+        "!{projectRoot}/integration/**/*",
+        "!{projectRoot}/acceptance/**/*",
+        "!{projectRoot}/dockerized/**/output/**/*"
+      ],
+      "options": {
+        "cwd": "{projectRoot}",
+        "commands": [
+          "pnpm vitest --run --config vitest.config.dockerized.mts dockerized/ssl"
+        ]
+      }
+    },
     "test-integration-run-login": {
       "description": "Runs the Login application under test. It has its own target, separate from test-integration, because it's a continuous task.",
       "dependsOn": [