1	## Summary
 2	- add optional `certmagic.*` runtime flags so filebrowser can automatically issue and renew TLS certificates for configured domains
 3	- integrate a new CertMagic listener path that is mutually exclusive with `--cert/--key` and `--socket`, while preserving existing static TLS and HTTP behavior
 4	- keep TLS minimum version at 1.2 and expose CA/email/storage/agreement knobs for production and staging ACME setups
   
 5	## Test plan
 6	- [x] `go test ./cmd/...`
 7	- [ ] Run filebrowser with `--certmagic.domains` on a real public domain and verify certificate issuance/renewal
   
 8	Made with [Cursor](https://cursor.com)