feat(daemon): CLI flags for custom gRPC TLS cert/key/CA paths

[cidrblock]

Context

PR #63 adds --grpc-tls with auto-generated self-signed certs. Custom PEM paths exist only as @internal options for tests (certPath / keyPath / caPath). Production/container users who bring org-issued certificates have no CLI surface.

Flagged during review of PR #63: #63

Proposal

• Expose something like --grpc-tls-cert, --grpc-tls-key, --grpc-tls-ca (names TBD)
• Keep auto-gen as the default for --grpc-tls with no paths
• Document usage in DEVELOPMENT.md / CONTAINER.md

References

• PR fix(daemon): require TLS or --insecure for non-loopback gRPC (C2) #63
• DR-029