feat(spa): opt-in 'https' nx serve config for dev-server TLS

Entra refuses http: redirect URIs for any host other than localhost,
which blocked the ADR-0030 dockerised dev mode the moment a developer
tried to share the stack with another teammate via a hostname (e.g.
apf-portal.dev.local). Add an opt-in 'https' Nx serve configuration
on both SPAs so the dev-server can terminate TLS using a mkcert cert,
and let the apps Compose profile pick the configuration via an env
var so behaviour stays unchanged by default.

- apps/portal-{shell,admin}/project.json: new https configuration
  inheriting development + ssl/sslKey/sslCert at .secrets/dev-tls.*.
- infra/local/dev.compose.yml: shell + admin commands gain
  --configuration=${NX_SERVE_CONFIGURATION:-development}, interpolated
  from infra/local/.env at parse time.
- infra/local/.env.example: NX_SERVE_CONFIGURATION block + rationale.
- apps/portal-bff/.env.example: comment block above the ENTRA_*_
  REDIRECT_URI defaults shows the https hostname override pattern and
  reminds that each URI must be registered Entra-side.
- infra/README.md: new HTTPS dev-server setup subsection covering
  mkcert install, cert generation, the .secrets/ convention, the
  Entra step, and how to flip NX_SERVE_CONFIGURATION on.

Native WSL / localhost is unaffected: defaultConfiguration stays
development, no SSL files required, existing Entra localhost URIs
work as before. BFF stays plain HTTP behind the SPA proxy.

infra/local/.env.example

@@ -35,3 +35,20 @@ OTEL_HTTP_PORT=4318
 PGWEB_PORT=8081
 JAEGER_UI_PORT=16686
 SERVE_STATIC_PORT=4200
+
+# ---------------------------------------------------------------- Apps (`--profile apps`)
+# Nx serve configuration for the SPA dev-servers. Two values matter:
+#   - `development` (default) — plain HTTP. Use with `localhost`
+#                               browser access; Entra accepts
+#                               `http://localhost:*` redirect URIs.
+#   - `https`                 — TLS-terminating dev-server using the
+#                               cert at `.secrets/dev-tls.{key,pem}`.
+#                               Required when accessing the SPA via a
+#                               hostname (e.g. `apf-portal.dev.local`)
+#                               since Entra rejects `http:` for any
+#                               non-`localhost` redirect URI. See the
+#                               "HTTPS dev-server setup" section of
+#                               infra/README.md for the mkcert
+#                               procedure and how to wire the
+#                               matching `ENTRA_REDIRECT_URI` value.
+# NX_SERVE_CONFIGURATION=https