Add IIS cert auto-import + private-key ACL (P0-1)
Operator-friendly HTTPS deploys: PFX bytes via Squid variable → script imports to LocalMachine\My, exposes thumbprint to Bindings JSON, grants AppPool identity private-key ACL after IIS configure. Mirrors Octopus's IisWebSite{Before,After}DeployFeature. +2 real-host tests, +1 drift detector. Zero breaking risk.