Add optional stratum TLS via stunnel sidecar

New 'tls' union config (disabled by default) spins up an
stunnel4 process inside the container that terminates TLS on
a configurable port (3334 by default) and forwards decrypted
stratum traffic to 127.0.0.1:${STRATUM_PORT}.

Cert is self-signed, generated once on first start with a
10-year validity and persisted at /root/.kamado/tls/ so the
fingerprint stays stable across restarts. SHA-256 fingerprint
is printed to container logs on each startup so users can
pin it on their miners. Miners must connect with
verification disabled (no CA trust chain for a private pool).

Runtime image grows by ~3MB for stunnel4 + openssl. The
supervisor loop now waits on three PIDs and tears all of them
down together if any one exits.

scripts/procedures/getConfig.ts

@@ -85,12 +85,43 @@ export const getConfig: T.ExpectedExports.getConfig = compat.getConfig({
     "type": "number",
     "name": "Stratum Port",
     "description":
-      "TCP port the stratum server listens on inside the container. Defaults to 3333. Change this if you are running simpleproxy (or another TCP forwarder) and want Kamado to listen on a different port — useful when another service on the same host already uses 3333.",
+      "TCP port the plaintext stratum server listens on inside the container. Defaults to 3333. Change this if you are running simpleproxy (or another TCP forwarder) and want Kamado to listen on a different port.",
     "nullable": false,
     "default": 3333,
     "range": "[1,65535]",
     "integral": true,
   },
+  "tls": {
+    "type": "union",
+    "name": "Stratum TLS",
+    "description":
+      "Accept stratum connections over TLS via an stunnel sidecar. A self-signed certificate is generated on first start and persisted across restarts — miners must connect with TLS verification disabled (most firmware exposes this as 'stratum+ssl://' with a skip-verify or insecure flag).",
+    "tag": {
+      "id": "enabled",
+      "name": "TLS Mode",
+      "description": "Disable or enable TLS termination in front of stratum.",
+      "variant-names": {
+        "disabled": "Disabled",
+        "enabled": "Enabled (stunnel sidecar)",
+      },
+    },
+    "default": "disabled",
+    "variants": {
+      "disabled": {},
+      "enabled": {
+        "port": {
+          "type": "number",
+          "name": "TLS Stratum Port",
+          "description":
+            "TCP port stunnel listens on for TLS stratum connections. Forwards decrypted traffic to the plaintext stratum port locally.",
+          "nullable": false,
+          "default": 3334,
+          "range": "[1,65535]",
+          "integral": true,
+        },
+      },
+    },
+  },
   "startdiff": {
     "type": "number",
     "name": "Starting Difficulty",