Console: redirect plain HTTP to HTTPS on a TLS port

[jthy10]

Reported from testing v1.4.0 on a phone: entering 192.168.x.x:8787 without https:// showed Go's "Client sent an HTTP request to an HTTPS server" error, because phone browsers try plain HTTP first.

What changes

• When the console serves HTTPS (LAN access on, or -tls-self-signed/-tls-cert), its listener peeks at the first byte of each connection. A TLS handshake (0x16) goes to the console as before. Anything else goes to a small server that answers with a 302 redirect to https://<same host><same path>.
• The redirect is temporary on purpose: if LAN access is turned off later, the local browser won't remember a redirect to an HTTPS port that no longer exists.
• The redirect server is closed together with the console when it moves or shuts down.

Testing

TestSelfSignedTLS now checks that plain HTTP on the TLS port returns a 302 with the right Location (path and query kept), and that HTTPS still serves the dashboard.