add TLS, service persistence, blocking panel, query types

- Local TLS: auto-generated CA + per-service certs (explicit SANs, not
  wildcards — browsers reject *.numa under single-label TLDs). HTTPS
  proxy on :443 via rustls/tokio-rustls. `numa install` trusts CA in
  macOS Keychain / Linux ca-certificates.
- Service persistence: user-added services saved to
  ~/.config/numa/services.json, survive restarts.
- Blocking panel: renamed "Check Domain" to "Blocking" with sources
  display, allowlist management UI, unpause button.
- Query types: recognize SOA, PTR, TXT, SRV, HTTPS (type 65) instead
  of logging as UNKNOWN.
- Blocklist gzip: reqwest now decompresses gzip responses from CDNs.
- Unified config_dir() in lib.rs for consistent path resolution under
  sudo and launchd. TLS certs use /usr/local/var/numa/ (writable as
  root daemon).
- Dashboard UX: panel subtitles differentiating overrides vs services,
  better placeholders, proxy route display, 600px query log height.
- Deploy: make deploy handles build+copy+codesign+restart cycle.
- Demo: scripts/record-demo.sh for recording hero GIF with CDP.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/config.rs

@@ -166,6 +166,8 @@ pub struct ProxyConfig {
     pub enabled: bool,
     #[serde(default = "default_proxy_port")]
     pub port: u16,
+    #[serde(default = "default_proxy_tls_port")]
+    pub tls_port: u16,
     #[serde(default = "default_proxy_tld")]
     pub tld: String,
 }
@@ -175,6 +177,7 @@ impl Default for ProxyConfig {
         ProxyConfig {
             enabled: default_proxy_enabled(),
             port: default_proxy_port(),
+            tls_port: default_proxy_tls_port(),
             tld: default_proxy_tld(),
         }
     }
@@ -186,6 +189,9 @@ fn default_proxy_enabled() -> bool {
 fn default_proxy_port() -> u16 {
     80
 }
+fn default_proxy_tls_port() -> u16 {
+    443
+}
 fn default_proxy_tld() -> String {
     "numa".to_string()
 }