Phase 9 bridge: cert download and HTML setup guide endpoints

- GET /_bridge/cert.pem — serves the TLS CA cert as a downloadable PEM file
  (only when TLS_ENABLED=true; 404 otherwise)
- GET /_bridge/guide — HTML setup page with hosts-file instructions, cert install
  steps per OS, and troubleshooting tips
- ProxyState gains cert_pem field (Arc<Vec<u8>>); set via with_cert() builder
- main.rs generates cert before state construction so /_bridge/cert.pem can serve it;
  both cert_pem and key_pem passed to serve_tls() for acceptor + state separately
- All 13 bridge tests pass, clippy clean

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/proxy.rs

@@ -31,6 +31,8 @@ pub struct ProxyState {
     pub capture_tx: Arc<broadcast::Sender<CapturedRequest>>,
     /// Deduplication window: (method+path) → last saved instant.
     pub dedup: Arc<Mutex<HashMap<String, Instant>>>,
+    /// PEM-encoded TLS certificate for download. None when TLS is disabled.
+    pub cert_pem: Option<Arc<Vec<u8>>>,
 }
 
 impl ProxyState {
@@ -45,8 +47,14 @@ impl ProxyState {
                 .expect("failed to build HTTP client"),
             capture_tx: Arc::new(capture_tx),
             dedup: Arc::new(Mutex::new(HashMap::new())),
+            cert_pem: None,
         }
     }
+
+    pub fn with_cert(mut self, cert_pem: Vec<u8>) -> Self {
+        self.cert_pem = Some(Arc::new(cert_pem));
+        self
+    }
 }
 
 /// Returns true if this (method, path) pair was already saved within the dedup window.