fix(landing): https + correct subdomains, drop dead CA-cert step

The guest landing page advertised http:// service URLs (mixed-content on the
https origin) and the wrong packwiz subdomain:
- authUrl / authlibUrl: http -> https
- packwizUrl: http://packwiz. -> https://pack.  (correct vhost)
- serverAddress: mc. -> apex (connect to ${BASE_DOMAIN}:25565)
- remove caCertUrl + the "trust the local CA" join step (airgap-only, /ca.crt
  no longer exists) and its en/es/eu i18n strings + type.

Also fix the stale http BaseURL example in plan/03-drasl.md.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

landing/src/data/site.ts

@@ -24,19 +24,15 @@ export const site = {
     dust: true,
   },
 
-  // Connect target shown to guests. No port needed — a dnsmasq SRV record
-  // (_minecraft._tcp.mc.<domain>) points clients at 25565.
-  serverAddress: `mc.${BASE_DOMAIN}`,
+  // Connect target shown to guests. No port needed (defaults to 25565).
+  serverAddress: `${BASE_DOMAIN}`,
 
-  // Drasl auth web UI + authlib-injector API root.
-  authUrl: `http://auth.${BASE_DOMAIN}`,
-  authlibUrl: `http://auth.${BASE_DOMAIN}/authlib-injector`,
+  // Drasl auth web UI + authlib-injector API root (public HTTPS).
+  authUrl: `https://auth.${BASE_DOMAIN}`,
+  authlibUrl: `https://auth.${BASE_DOMAIN}/authlib-injector`,
 
-  // packwiz modpack entrypoint.
-  packwizUrl: `http://packwiz.${BASE_DOMAIN}/pack.toml`,
-
-  // Caddy local CA root — guests import this to trust the offline asset mirror.
-  caCertUrl: `http://${BASE_DOMAIN}/ca.crt`,
+  // packwiz modpack entrypoint (public HTTPS, pack. subdomain).
+  packwizUrl: `https://pack.${BASE_DOMAIN}/pack.toml`,
 
   // Static server-list panel (Status section). No fake live count — see plan
   // 09-landing.md option B.