chore(oauth): make dev-server https conditional on local mkcert certs; gitignore them

The server.https config now enables only when webapp/localhost*.pem exist, so a normal 'vite dev'
without the certs stays plain http; the certs are gitignored.

Author: bdshadow

.gitignore

@@ -94,3 +94,6 @@ ngrok.local.yml
 # mcp-publisher auth tokens
 /.mcpregistry_github_token
 /.mcpregistry_registry_token
+
+# local mkcert certs for OAuth browser-extension https testing (webapp/vite.config.ts)
+/webapp/localhost*.pem

webapp/vite.config.ts

@@ -14,6 +14,15 @@ import { sentryVitePlugin } from '@sentry/vite-plugin';
 const billingFrontendDir = resolve(__dirname, '../../billing/frontend');
 const hasBilling = existsSync(billingFrontendDir);
 
+// Optional trusted HTTPS for local OAuth browser-extension testing (chrome.identity requires HTTPS).
+// Generate with `mkcert localhost` in webapp/; without the files the dev server stays plain http.
+const localCert = resolve(__dirname, 'localhost.pem');
+const localCertKey = resolve(__dirname, 'localhost-key.pem');
+const devHttps =
+  existsSync(localCert) && existsSync(localCertKey)
+    ? { cert: localCert, key: localCertKey }
+    : undefined;
+
 export default defineConfig(({ mode }) => {
   process.env = { ...process.env, ...loadEnv(mode, process.cwd()) };
 
@@ -78,7 +87,7 @@ export default defineConfig(({ mode }) => {
       exclude: ['@tginternal/library'],
     },
     server: {
-      https: { cert: 'localhost.pem', key: 'localhost-key.pem' },
+      https: devHttps,
       // this ensures that the browser opens upon server start
       open: true,
       host: process.env.VITE_HOST || undefined,