feat(preflight): skip :443 check in HTTP-only deployments + OUTPUT-chain caveat

The :443 reachability preflight was emitting a WARN on every deployment
where AfterTouch's configured --server-url is HTTP (not HTTPS), even
when speakers were migrated to that HTTP URL and never connect to :443.
Operators reproduced this on #218 (CTonyPeterson) and #344
(california444) — both saw the warning even though their setups had no
need for iptables port forwarding, and CTonyPeterson followed the
recommended iptables OUTPUT rule which then caught his host's own
outbound HTTPS traffic and broke `go install` and his browser.

Two changes:

- Probe443Result gains NotApplicable + Reason. Check443Reachability
  returns the NotApplicable verdict when the parsed serverURL scheme is
  http. The settings UI renders an ℹ️ info badge with the reason instead
  of a red ✗.
- FormatPreflightGuidance grows a one-line caveat about the iptables
  OUTPUT chain: it catches all outbound :443 on the host, including
  browsers / go install / apt-get, which is rarely what the operator
  wants.

HTTPS-SETUP.md gains the same caveat plus a section documenting the
new not-applicable verdict.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

cmd/soundtouch-service/main.go

@@ -1304,7 +1304,12 @@ func runHTTPSPreflight(httpsServerURL, serverURL string, dnsEnabled bool, resolv
 
 	guidance := handlers.FormatPreflightGuidance(port, res)
 	if guidance == "" {
-		if !res.Skipped {
+		switch {
+		case res.Skipped:
+			// Listener already on :443 — nothing to say.
+		case res.NotApplicable:
+			log.Printf("HTTPS pre-flight: :443 check skipped — %s", res.Reason)
+		default:
 			log.Printf("HTTPS pre-flight: :443 reachable at localhost and %s ✓", res.LANHost)
 		}