Revives #416 now that nodes have a shared state database. With --secure and --acme the node obtains and renews certificates from an ACME CA (Let's Encrypt by default) instead of reading --tls-cert/--tls-key. certmagic's Storage is backed by a new certmagic_items table, so every node in a station serves the same certificates and can answer an HTTP-01 challenge another node started. Its Locker is the existing statedb named lock: on Postgres a session-scoped advisory lock, released automatically if the holder dies, so the old file-lock staleness logic is gone. The managed names are the broadcaster host, the server host when it is a distinct identity, and --acme-domains. One tls.Config with per-SNI selection serves HTTPS, RTMPS and the RTMPS addon; HTTP-01 is answered on the port-80 redirect listener and TLS-ALPN-01 on 443. Issuance runs in the background so a node with wrong DNS still starts and logs the CA's error. Storage and locking semantics are unit-tested against sqlite; issuance against a real CA is not yet exercised. Claude-Session: https://claude.ai/code/session_014aPQ5yqG9QFxKnbwQfCYKa (cherry picked from commit 6308a7d827a3a09b2a1ee4e25f873c50189361f1)