Add optional stratum TLS via stunnel sidecar

New 'tls' union config (disabled by default) spins up an
stunnel4 process inside the container that terminates TLS on
a configurable port (3334 by default) and forwards decrypted
stratum traffic to 127.0.0.1:${STRATUM_PORT}.

Cert is self-signed, generated once on first start with a
10-year validity and persisted at /root/.kamado/tls/ so the
fingerprint stays stable across restarts. SHA-256 fingerprint
is printed to container logs on each startup so users can
pin it on their miners. Miners must connect with
verification disabled (no CA trust chain for a private pool).

Runtime image grows by ~3MB for stunnel4 + openssl. The
supervisor loop now waits on three PIDs and tears all of them
down together if any one exits.

Dockerfile

@@ -73,7 +73,7 @@ FROM debian:bookworm-slim AS runtime
 ARG ARCH
 ARG YQ_VERSION=v4.44.3
 RUN apt-get update && apt-get install -y --no-install-recommends \
-        tini ca-certificates curl libzmq5 \
+        tini ca-certificates curl libzmq5 stunnel4 openssl \
     && rm -rf /var/lib/apt/lists/*
 
 # yq for reading StartOS config.yaml in the entrypoint
@@ -95,6 +95,6 @@ COPY docker_entrypoint.sh /usr/local/bin/docker_entrypoint.sh
 RUN chmod +x /usr/local/bin/docker_entrypoint.sh \
     && mkdir -p /run/ckpool /var/log/ckpool /var/lib/kamado
 
-EXPOSE 3333 8080
+EXPOSE 3333 3334 8080
 WORKDIR /root
 ENTRYPOINT ["/usr/bin/tini", "--", "/usr/local/bin/docker_entrypoint.sh"]