Docker: automatic SSL with a self-signed certificate, reused if present

docker-entrypoint.sh uses the given SSL_CERTFILE/SSL_KEYFILE, or the
certificate in the electrumx-ssl volume, and generates a self-signed one
(10 years) only when none exists, never overwriting it, as clients pin it.
It also sets SERVICES (tcp 50001 + ssl 50002). SSL is on by default.

Documented in README.md and DEPLOY.md.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

.env.example

@@ -5,3 +5,12 @@ PLM_RPC_PASSWORD=change-me
 #CACHE_MB=1200
 #REPORT_SERVICES=tcp://electrum.example.com:50001
 #ELECTRUMX_TCP_PORT=50001
+
+# SSL (port 50002): on by default, self-signed certificate generated once and kept in the electrumx-ssl volume.
+#SSL_ENABLED=true
+# name (or IP) of the server, written in the generated certificate
+#SSL_HOSTNAME=electrum.example.com
+#ELECTRUMX_SSL_PORT=50002
+# your own certificate (paths inside the container; mount the files, see DEPLOY.md):
+#SSL_CERTFILE=/certs/fullchain.pem
+#SSL_KEYFILE=/certs/privkey.pem