fix(landing): https + correct subdomains, drop dead CA-cert step

The guest landing page advertised http:// service URLs (mixed-content on the
https origin) and the wrong packwiz subdomain:
- authUrl / authlibUrl: http -> https
- packwizUrl: http://packwiz. -> https://pack.  (correct vhost)
- serverAddress: mc. -> apex (connect to ${BASE_DOMAIN}:25565)
- remove caCertUrl + the "trust the local CA" join step (airgap-only, /ca.crt
  no longer exists) and its en/es/eu i18n strings + type.

Also fix the stale http BaseURL example in plan/03-drasl.md.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

plan/03-drasl.md

@@ -16,7 +16,7 @@ Config is **TOML only** (no env var support). So `config.toml` is rendered from
 ## config.toml.tmpl (key fields)
 
 ```toml
-BaseURL       = "http://auth.${BASE_DOMAIN}"
+BaseURL       = "https://auth.${BASE_DOMAIN}"   # public scheme is HTTPS (nginx TLS)
 Domain        = "auth.${BASE_DOMAIN}"
 ListenAddress = "0.0.0.0:25585"          # internal; Caddy proxies
 DefaultAdminUsernames = ["admin"]