feat(spa): opt-in 'https' nx serve config for dev-server TLS

Entra refuses http: redirect URIs for any host other than localhost,
which blocked the ADR-0030 dockerised dev mode the moment a developer
tried to share the stack with another teammate via a hostname (e.g.
apf-portal.dev.local). Add an opt-in 'https' Nx serve configuration
on both SPAs so the dev-server can terminate TLS using a mkcert cert,
and let the apps Compose profile pick the configuration via an env
var so behaviour stays unchanged by default.

- apps/portal-{shell,admin}/project.json: new https configuration
  inheriting development + ssl/sslKey/sslCert at .secrets/dev-tls.*.
- infra/local/dev.compose.yml: shell + admin commands gain
  --configuration=${NX_SERVE_CONFIGURATION:-development}, interpolated
  from infra/local/.env at parse time.
- infra/local/.env.example: NX_SERVE_CONFIGURATION block + rationale.
- apps/portal-bff/.env.example: comment block above the ENTRA_*_
  REDIRECT_URI defaults shows the https hostname override pattern and
  reminds that each URI must be registered Entra-side.
- infra/README.md: new HTTPS dev-server setup subsection covering
  mkcert install, cert generation, the .secrets/ convention, the
  Entra step, and how to flip NX_SERVE_CONFIGURATION on.

Native WSL / localhost is unaffected: defaultConfiguration stays
development, no SSL files required, existing Entra localhost URIs
work as before. BFF stays plain HTTP behind the SPA proxy.

infra/local/dev.compose.yml

@@ -266,7 +266,27 @@ services:
       # /api proxy at the BFF container by name (Compose DNS). Native
       # `nx serve` leaves BFF_TARGET unset and falls back to localhost.
       BFF_TARGET: http://portal-bff:3000
-    command: ['pnpm', 'exec', 'nx', 'serve', 'portal-shell', '--host', '0.0.0.0', '--port', '4200']
+    # `--configuration=${NX_SERVE_CONFIGURATION:-development}` is
+    # interpolated by Compose at YAML parse time from
+    # `infra/local/.env`. Set `NX_SERVE_CONFIGURATION=https` there to
+    # serve over TLS — required when accessing via a hostname (Entra
+    # rejects `http:` for non-`localhost` redirect URIs). See the
+    # `https` configuration in apps/portal-shell/project.json + the
+    # "HTTPS dev-server setup" section in infra/README.md for the
+    # mkcert procedure.
+    command:
+      [
+        'pnpm',
+        'exec',
+        'nx',
+        'serve',
+        'portal-shell',
+        '--host',
+        '0.0.0.0',
+        '--port',
+        '4200',
+        '--configuration=${NX_SERVE_CONFIGURATION:-development}',
+      ]
     ports:
       - '${SHELL_PORT:-4200}:4200'
     depends_on:
@@ -279,7 +299,20 @@ services:
     environment:
       # See portal-shell — same proxy target for the admin SPA.
       BFF_TARGET: http://portal-bff:3000
-    command: ['pnpm', 'exec', 'nx', 'serve', 'portal-admin', '--host', '0.0.0.0', '--port', '4300']
+    # See portal-shell for the NX_SERVE_CONFIGURATION rationale.
+    command:
+      [
+        'pnpm',
+        'exec',
+        'nx',
+        'serve',
+        'portal-admin',
+        '--host',
+        '0.0.0.0',
+        '--port',
+        '4300',
+        '--configuration=${NX_SERVE_CONFIGURATION:-development}',
+      ]
     ports:
       - '${ADMIN_PORT:-4300}:4300'
     depends_on: