fix(web): trust service CA and send a known target for TTS

soundtouch-web's "Speak" feature proxies to the AfterTouch service's
/setup/tts/speak endpoint. Two issues blocked it end to end.

1. TLS: the proxy used http.DefaultClient, which trusts only system
   roots, so the HTTPS call to a service using its own self-signed CA
   failed with "x509: certificate signed by unknown authority". Add a
   --service-ca flag (SERVICE_CA env) that loads the CA PEM, appends it
   to the system pool, and uses a custom client for the TTS call.

2. Target: soundtouch-web sent device.Client.Host() (a full base URL
   like http://ip:8090), but the service's SSRF guard exact-matches the
   target against bare datastore IPs, returning "host ... is not a known
   device". Prefer the device ID (the canonical key) and send a bare-IP
   host fallback. Also normalize the incoming host in resolveTTSHost so a
   URL/host:port form still resolves; it still only ever returns a
   datastore IP, so the SSRF guarantee is unchanged.

Adds unit tests for the CA client builder, hostOnly, and resolveTTSHost
(including the preserved unknown-host/device rejections). Documents
--service-ca in the soundtouch-web README and TROUBLESHOOTING guide.
Wires SERVICE_URL and SERVICE_CA (empty defaults) into the Raspberry Pi
install-web.sh env file and documents them in the Pi guide.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

scripts/raspberry-pi/install-web.sh

@@ -14,6 +14,12 @@ set -euo pipefail
 #     HTTP_PORT=8081 \
 #     bash install-web.sh
 #
+#   # With an AfterTouch service link for TTS (HTTPS + self-signed CA):
+#   sudo \
+#     SERVICE_URL=https://soundtouch.local \
+#     SERVICE_CA=/var/lib/soundtouch-service/certs/ca.crt \
+#     bash install-web.sh
+#
 # Or with a version argument to perform an update:
 #   sudo bash install-web.sh v0.104.0
 #
@@ -48,6 +54,13 @@ BIND_ADDR="${BIND_ADDR:-}"
 DISCOVERY_INTERFACE="${DISCOVERY_INTERFACE:-}"
 SOUNDTOUCH_DEVICES="${SOUNDTOUCH_DEVICES:-}"
 
+# Optional AfterTouch service link (needed for TTS / "Speak").
+# SERVICE_URL: base URL of soundtouch-service, e.g. https://soundtouch.local
+# SERVICE_CA:  path to the service CA cert when it serves HTTPS with its own
+#              self-signed certificate, e.g. /var/lib/soundtouch-service/certs/ca.crt
+SERVICE_URL="${SERVICE_URL:-}"
+SERVICE_CA="${SERVICE_CA:-}"
+
 # Override if you want to force a specific asset suffix:
 #   ARCH_ASSET=linux-armv7|linux-arm64|linux-amd64
 ARCH_ASSET="${ARCH_ASSET:-}"
@@ -179,6 +192,7 @@ self_update() {
 
   export IS_SELF_UPDATE="true"
   export VERSION HTTP_PORT BIND_ADDR DISCOVERY_INTERFACE SOUNDTOUCH_DEVICES
+  export SERVICE_URL SERVICE_CA
   export BIN_PATH CONFIG_DIR ENV_FILE SERVICE_USER SERVICE_GROUP
 
   exec "${SCRIPT_PATH}" "$@"
@@ -192,6 +206,8 @@ write_env_file() {
     "BIND_ADDR=${BIND_ADDR}"
     "DISCOVERY_INTERFACE=${DISCOVERY_INTERFACE}"
     "SOUNDTOUCH_DEVICES=${SOUNDTOUCH_DEVICES}"
+    "SERVICE_URL=${SERVICE_URL}"
+    "SERVICE_CA=${SERVICE_CA}"
   )
 
   if [[ ! -f "${ENV_FILE}" ]]; then