fix: enable TLS when WebAppURL is manually configured as HTTPS

The TLS certificate fetch was coupled inside the auto-detection block,
so a manually configured https:// WebAppURL would skip cert loading
entirely, causing the server to serve plain HTTP while Telegram
expected HTTPS — resulting in a blank Mini App.

Split URL resolution and TLS setup into separate steps so that any
https:// URL (auto-detected or configured) triggers cert loading.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

cmd/picoclaw/internal/gateway/helpers.go

@@ -274,7 +274,7 @@ func setupAndStartServices(
 	if cfg.Channels.Telegram.Enabled {
 		webAppURL := cfg.Channels.Telegram.WebAppURL
 		if webAppURL == "" {
-			// Auto-detect Tailscale hostname and fetch TLS cert
+			// Auto-detect Tailscale hostname and build the WebAppURL
 			hostname, tsErr := tailscale.DetectHostname()
 			if tsErr != nil {
 				logger.InfoCF(
@@ -282,15 +282,26 @@ func setupAndStartServices(
 					"Tailscale not available, Mini App disabled",
 					map[string]any{"error": tsErr.Error()},
 				)
+			} else {
+				hostPort := net.JoinHostPort(hostname, strconv.Itoa(cfg.Gateway.Port))
+				webAppURL = "https://" + hostPort + "/miniapp"
+				cfg.Channels.Telegram.WebAppURL = webAppURL
+			}
+		}
+
+		// When the URL is HTTPS, fetch a TLS certificate from Tailscale so
+		// the server can actually serve over TLS. This covers both the
+		// auto-detected case above and a manually configured https:// URL.
+		if strings.HasPrefix(webAppURL, "https://") {
+			hostname, tsErr := tailscale.DetectHostname()
+			if tsErr != nil {
+				logger.ErrorCF("miniapp", "HTTPS URL configured but Tailscale not available", map[string]any{"error": tsErr.Error()})
 			} else {
 				certDir := filepath.Join(cfg.WorkspacePath(), "state", "certs")
 				certFile, keyFile, certErr := tailscale.FetchCert(hostname, certDir)
 				if certErr != nil {
 					logger.ErrorCF("miniapp", "Failed to fetch TLS cert", map[string]any{"error": certErr.Error()})
 				} else {
-					hostPort := net.JoinHostPort(hostname, strconv.Itoa(cfg.Gateway.Port))
-					webAppURL = "https://" + hostPort + "/miniapp"
-					cfg.Channels.Telegram.WebAppURL = webAppURL
 					tlsCert, tlsKey = certFile, keyFile
 					useTLS = true
 				}