[simonvanlierde]

Three small follow-ups to the local HTTPS support in 0.7.2, from a correctness review of the release.

• A passphrase-protected TLS_KEY_FILE made OpenSSL try to prompt for the password: in the container that failed with a cryptic [Errno 22] Invalid argument, and on a host with a terminal startup would wait at the prompt. validate_tls_files now loads the key with an empty password, so it fails at once with "the key must be unencrypted".
• The NOTE comments in pyproject.toml still said the image runs fastapi run; it runs app/serve.py since 0.7.2.
• INSTALL says the key must be unencrypted, and that the TLS settings belong in the .env next to compose.yml, so the container's healthcheck sees them too.

Tests: the new encrypted-key test failed with the [Errno 22] message before the change. just check passes (946 passed).

[codspeed]

Merging this PR will not alter performance

1 warning

⚠️ 4 benchmarks are dominated by system calls

System calls cannot be simulated consistently and are left out of the measure. The reported value understates the real cost. Switch to the Walltime instrument to measure them.

Learn more about system calls

See affected benchmarks

✅ 12 untouched benchmarks

---

_{Comparing fix/tls-key-password-and-notes (0ba2bd4) with main (f89df2a)}