Append CA certificate to complete TLS chain in AutoCert plugin

[Copilot]

Summary

Applies the fix proposed in #362 (closed without merge): when the AutoCert plugin auto-generates a self-signed TLS certificate (i.e. no -cert/-certKey supplied), append the CA certificate's PEM block after the leaf certificate's PEM block so config.C.TLSCertificate contains a complete leaf+CA chain.

Why

Some TLS clients fail to build/verify the certificate chain locally and report a "TLS handshake error" when only the leaf certificate is served without the CA. Serving the full chain (leaf + CA) is standard practice and resolves this for those clients.

Change

• plugin/autocert.go: one additional pem.Encode call appending catls.Certificate[0] (the CA's DER bytes, already loaded in memory) to the certificate buffer.

Scope / Safety

• Only affects the AutoCert code path, gated by if *config.C.ForceHTTP == false && len(*config.C.TLSCertificate) == 0 && len(*config.C.TLSKey) == 0. Users supplying their own certificate/key, or running with -forceHttp, are unaffected — this branch is skipped entirely for them.
• Verified with a standalone Go reproduction that tls.X509KeyPair correctly parses the concatenated PEM blocks into an ordered []byte chain ([leaf, ca]), matching Go's expected leaf-first certificate chain format.
• No code in the repo assumes the certificate chain slice (tls.Certificate.Certificate) has exactly one element.
• go build ./..., go vet ./..., and go test ./... all pass.
• No secrets introduced (scanned changed file).

Testing

• go build ./... — passes
• go vet ./... — passes
• go test ./... — passes (no existing tests cover plugin/autocert.go, none broken)