TLS options: --cacert, client certificates (mTLS) and JetBrains SSLConfiguration #39

Why

The only TLS control is --insecure. Internal APIs behind a private CA and mTLS gateways (common in the AWS and Kubernetes worlds apic targets with SigV4) cannot be reached without turning verification off. JetBrains projects already describe client certs in http-client.private.env.json under SSLConfiguration; apic should read that so a JetBrains project works unchanged.

What

Acceptance criteria:

• Flags: --cacert <pem> (adds to the system roots), --cert <pem> and --key <pem> (client certificate; PKCS#12 via --cert file.p12 --cert-password is optional).
• apic.yaml:

  tls:
    caFile: certs/internal-ca.pem
    certFile: certs/client.pem
    keyFile: certs/client-key.pem
    verifyHost: true
    hosts:                      # optional per-host overrides
      api.internal.example.com: { certFile: ..., keyFile: ... }

• JetBrains compatibility: read "SSLConfiguration": {"clientCertificate": {"path": ..., "keyPath": ...}, "hasCertificatePassphrase": ..., "verifyHostCertificate": ...} from the env files for the selected environment.
• Paths resolve relative to the project root and are confined to it. Key files are refused if world-readable, with a message naming the mode (same posture as the private env file).
• describe shows tls: client cert certs/client.pem when one applies; apic curl maps to --cacert, --cert, --key.
• --insecure still means what it means and is reported in output.

Where

internal/runner/runner.go (transport at 749-792), internal/project/project.go (config), internal/env/env.go (JetBrains block), internal/cli/root.go (flags), internal/curlexport/curl.go, internal/cli/inspect.go (describe).

Docs

docs/cli.md (flags, config), docs/auth.md (new "TLS and client certificates" section), docs/cheatsheet.md, docs/comparison.md (client certs row), docs/faq.md.

Tests

httptest.NewUnstartedServer with TLS.ClientAuth = RequireAndVerifyClientCert and a generated CA: success with cert, failure without, custom CA trusted, JetBrains block parsed, world-readable key refused.