feat(config): add secure flag to opt into HTTPS in base_url

[terafin]

Summary

Helpers currently hardcode http:// regardless of port, which makes them unusable against HTTPS backends. Users running modern home setups (Traefik / nginx / Caddy with auto-TLS) need to fall back to a parallel HTTP route on their backend just to keep the helper working.

Adds an opt-in secure: bool field so base_url() returns https://... when set. Defaults to false — every existing config.ini is byte-identical to before. Applied identically across mister / steamdeck / windows helpers.

Why

Real-world hit: Steam Deck and SS1 currently sync to saves-sync.siliconspirit.net:80 because that's the only path the helper can speak. Adding a Windows helper (arcade PC) revealed the same — port 443 with http:// scheme returns 404 from Traefik. Forcing a parallel HTTP route on the backend isn't tenable for setups that want TLS-only.

What

• AppConfig gains secure: bool (default false).
• ConfigOverrides gains secure: Option<bool>.
• from_sources reads SECURE env/ini via existing choose_bool helper.
• base_url():

  pub fn base_url(&self) -> String {
      let scheme = if self.secure { "https" } else { "http" };
      format!("{}://{}:{}", scheme, self.url, self.port)
  }

• Same exact change in all three helpers.

Tests

• base_url_uses_https_when_secure_true — happy path: SECURE=true + PORT=443 → https://host:443
• base_url_remains_http_when_secure_unset_for_backwards_compat — regression guard: no SECURE set → byte-identical http://host:port (proves no behavior change for existing users)

Both tests in every helper (6 new tests total).

Migration

For users wanting HTTPS, add to config.ini:

URL = saves.example.com
PORT = 443
SECURE = true

Scope

• Opt-in only. No existing config changes behavior unless SECURE=true is added.
• A --secure CLI flag could follow in a separate PR if desired.

🤖 Generated with Claude Code