Update cert config

Dockerfile

@@ -32,28 +32,15 @@ LABEL org.opencontainers.image.title="Budgeteer" \
 # Ensure the SQLite data directory exists and is writable
 RUN mkdir -p /app/data
 
+# Ensure the cert directory exists and is writable
+RUN mkdir -p /app/data/certs
+
 # HSTS domain — read by the app via Hsts:Domain config
 ENV Hsts__Domain=nas.oneputleygreen.com
 
-# Copy the SSL certificate (CN=nas.oneputleygreen.com).
-# Place cert.pem and key.pem in certs/ before building — excluded from git via certs/* in .gitignore.
-# If cert.pem is absent (e.g. CI builds) a self-signed fallback is generated automatically.
-COPY certs/ /app/certs/
-RUN if [ ! -f /app/certs/cert.pem ]; then \
-        echo "No cert.pem found — generating self-signed certificate for ${Hsts__Domain}" && \
-        openssl req -x509 -newkey rsa:4096 \
-            -keyout /app/certs/key.pem \
-            -out /app/certs/cert.pem \
-            -days 3650 \
-            -nodes \
-            -subj "/C=GB/ST=England/O=Budgeteer/CN=${Hsts__Domain}"; \
-    fi
-
 # Serve on both HTTP and HTTPS
 ENV ASPNETCORE_HTTP_PORTS=8181
 ENV ASPNETCORE_HTTPS_PORTS=8282
-ENV ASPNETCORE_Kestrel__Certificates__Default__Path=/app/certs/cert.pem
-ENV ASPNETCORE_Kestrel__Certificates__Default__KeyPath=/app/certs/key.pem
 
 # Store the database in the volume-mountable /app/data directory
 ENV ConnectionStrings__DefaultConnection="Data Source=/app/data/budgetapp.db"
@@ -67,5 +54,6 @@ ENV Authentication__Google__ClientId="" \
     Authentication__Facebook__ClientSecret=""
 
 VOLUME ["/app/data"]
+VOLUME ["/app/data/certs"]
 
 ENTRYPOINT ["dotnet", "BudgetApp.dll"]