docs: the supported way to reach a TUI-hosted document over https

Per the user's ruling on improvise-o8fa: document the reverse-proxy path
properly, implement no TLS.

The existing text already named the symptom correctly -- an https origin
refuses `ws://` as mixed content, `improvise-ws-server` has no TLS, so
`wss://` is unobtainable from it -- but it gestured at "a reverse proxy or a
tunnel" and stopped, which is not something a reader can follow. So README
gains a worked Caddy example (Caddyfile, both commands, and the `?ws=` value
to reload with), the nginx difference that actually bites (`proxy_http_version
1.1` plus the Upgrade/Connection headers, without which the handshake is
answered as an ordinary request), the cloudflared/ngrok one-liners, and the
note that `--bind` should be left at loopback behind a proxy on the same host.

It also says the cost rather than papering it: the documented path to sharing
involves a second piece of software, which is a poor answer for a tool whose
selling point is being one binary. And it says what that cost buys against --
the standalone worker deployment is the point of the Pages site and needs no
server at all, and `http://localhost` pairing needs none of this either.

Native `wss://` is recorded as DECLINED WITH REASON rather than left as a gap.
The substance is the certificate, not rustls: a self-signed cert makes the
browser refuse the socket with no usable error, because a websocket handshake
has no interstitial to click through. A real cert or mkcert are the only
pleasant options and both are a second piece of software too -- so the choice
is not one binary versus two, it is two either way, with one option
additionally shipping a TLS stack in a pivot-table binary.

web/index.html is the second home for the same fact and is updated to point at
the worked example rather than restating it (gotcha 48: a fact stated twice is
a grep). Both were checked for text the correction left stale.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

web/index.html

@@ -65,9 +65,13 @@
       <code>wss://</code></strong>, because this page is served over https and
       an https origin refuses a <code>ws://</code> address as mixed content.
       Note that <code>improvise-ws-server</code> speaks plain
-      <code>ws://</code> only, so reaching it from here means terminating TLS
-      in front of it. Served over <code>http://localhost</code> the same page
-      defaults to <code>ws://</code> and pairs with it directly.
+      <code>ws://</code> only, so reaching it from <em>this</em> page means
+      terminating TLS in front of it with a reverse proxy or a tunnel — the
+      README has a worked Caddy example. Served over
+      <code>http://localhost</code> the same page defaults to
+      <code>ws://</code> and pairs with it directly, with nothing in between;
+      that is the case the pairing is really for. Sharing a document is what
+      the server is for — not running one is what everything above is for.
     </p>
 
     <main>