HTTPS: eigene lokale Root-CA statt externem DuckDNS/Let's Encrypt

apps/frontend/nginx-locations.conf

@@ -26,6 +26,14 @@ location = /manifest.webmanifest {
     try_files $uri =404;
 }
 
+# Root-CA zum Download – Android/iOS erkennen diesen MIME-Type und bieten
+# beim Öffnen im Browser direkt "Zertifikat installieren" an.
+location = /ca.crt {
+    add_header Cache-Control "no-cache";
+    default_type application/x-x509-ca-cert;
+    try_files $uri =404;
+}
+
 location ~* \.(?:css|js|svg|png|jpg|jpeg|gif|ico|woff2?)$ {
     expires 7d;
     add_header Cache-Control "public, max-age=604800, immutable";