fix(effect): restore HTTPS bind on 0.0.0.0 after Phase 8 daemon migration

[dibstern]

Summary

• Threads full daemon runtime config from startup into DaemonConfigRef, including bind settings, TLS state, keep-awake config, dismissed paths, and persisted session counts.
• Makes DaemonLifecycleContext a server-handle sink only; host/port/tls are removed from its interface.
• startHttpServer / startOnboardingServer accept explicit config params instead of reading mutable ctx fields.
• makeHttpServerLive / makeOnboardingServerLive read host/port from DaemonConfigRefTag and TLS/CA material from TlsCertTag.
• Writes the actual bound port back into the Ref and uses that value for status, setup-info, persistence, redirects, and the daemon handle.
• Deletes the obsolete post-runtime-build sync block and keeps shutdown persistence refreshed from the live Ref before runtime disposal.

Root cause

Phase 8 (b3d0f8b) introduced DaemonConfigRefTag but left the server bind path split between the Ref and stale mutable DaemonLifecycleContext fields. tlsEnabled and hostExplicit were not threaded into the initial Ref, so cert loading could short-circuit; server startup then read the pre-TLS ctx snapshot and bound to the wrong interface.

Test plan

• pnpm check
• pnpm lint
• pnpm test:unit
• pnpm test:all
• Foreground daemon stdout reports Relay: https://0.0.0.0:2633.
• lsof -nP -i :2633 shows *:2633, not 127.0.0.1:2633.
• curl -k https://$TS_IP:2633/api/status returns JSON with tlsEnabled: true and host: "0.0.0.0".
• HTTP to http://$TS_IP:2633/ redirects to https://$TS_IP:2633/.
• Onboarding server on $TS_IP:2634 serves /api/setup-info with correct URLs and /ca/download returns cert content.

[Copilot]

Pull request overview

This PR fixes the daemon’s server binding/config threading after the Phase 8 migration by making the live DaemonConfigRef the single source of truth for host/port/TLS state, ensuring HTTPS binds correctly (e.g., 0.0.0.0) and that the actual ephemeral port is propagated consistently across status/setup-info/persistence.

Changes:

• Refactors server startup to take explicit bind/TLS config and to write the actual bound port back into DaemonConfigRef.
• Reworks SetupInfoProvider to use getter functions so /api/setup-info reflects live port/TLS changes.
• Adds/updates unit tests covering binding behavior, onboarding setup-info composition, and daemon status/persistence after runtime config updates.

Reviewed changes

Copilot reviewed 18 out of 18 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
test/unit/server/http-server-layer.test.ts	Updates SetupInfoProvider test wiring to use live getters and adds coverage for dynamic setup-info values.
test/unit/effect/layer-wiring.test.ts	Updates daemon layer wiring tests to seed full initial config and assert ref reflects actual ephemeral port.
test/unit/effect/http-server-live.test.ts	Adds integration-style layer tests for HTTP/onboarding servers, TLS material usage, and config ref port handoff.
test/unit/effect/daemon-main-getstatus.test.ts	Adds daemon-main status/persistence tests covering TLS host/port reporting and restart config application.
test/unit/effect/daemon-config-ref.test.ts	Extends config-ref tests to cover tlsEnabled/hostExplicit propagation.
test/unit/daemon/daemon-onboarding.test.ts	Updates onboarding lifecycle tests for the new explicit onboarding start config.
test/unit/daemon/daemon-lifecycle-ipc.test.ts	Adjusts lifecycle IPC tests for removal of host/port from lifecycle context.
test/unit/daemon/daemon-lifecycle-bind.test.ts	Adds lifecycle bind tests verifying startHttpServer returns actual port and redirects don’t use :0.
test/fixtures/test-key.pem	Adds TLS key fixture used by new TLS-focused tests.
test/fixtures/test-cert.pem	Adds TLS cert fixture used by new TLS-focused tests.
src/lib/server/effect-http-router.ts	Changes SetupInfoProvider contract to getters and uses live values when composing URLs.
src/lib/relay/relay-stack.ts	Updates relay stack to provide SetupInfoProvider via getters.
src/lib/effect/daemon-main.ts	Threads full runtime config into DaemonConfigRef, snapshots/updates runtime config, and removes reliance on mutable ctx bind fields.
src/lib/effect/daemon-layers.ts	Makes HTTP/onboarding server layers read bind/TLS from tags, start with explicit configs, and write back actual port.
src/lib/effect/daemon-config-ref.ts	Extends config creation to accept explicit hostExplicit.
src/lib/daemon/daemon-lifecycle.ts	Refactors startHttpServer/startOnboardingServer to accept explicit start configs and returns actual bound port; improves close behavior.
pnpm-workspace.yaml	Updates pnpm build allowlist/denylist configuration.
package.json	Adjusts pnpm built-dependency allow/ignore configuration.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.