feat: support multiple CAs through documentation

docs/configuration/index.md

@@ -86,37 +86,12 @@ To enable debug logging, set the **`HEADPLANE_DEBUG_LOG=true`** environment vari
 This will enable all debug logs for Headplane, which could fill up log space very quickly.
 This is not recommended in production environments.
 
-## TLS Termination
+## TLS & Certificates
 
-Headplane can terminate TLS itself when both `server.tls_cert_path` and
-`server.tls_key_path` are set in the configuration file. Both must point to
-PEM-encoded files that Headplane can read.
-
-```yaml
-server:
-  port: 443
-  tls_cert_path: "/var/lib/headplane/tls/fullchain.pem"
-  tls_key_path: "/var/lib/headplane/tls/privkey.pem"
-```
-
-When TLS is configured Headplane serves HTTPS/1.1 on `server.port`. HTTP/2
-and HTTP/3 are intentionally not supported in-process — terminate those at a
-reverse proxy (e.g. Caddy or Traefik) and forward to Headplane over HTTP/1.1
-if you need them today.
-
-`server.cookie_secure` is forced to `true` whenever TLS is enabled (browsers
-refuse `Secure`-less cookies over HTTPS); a warning is logged if your config
-had it set to `false`.
-
-For most deployments we still recommend terminating TLS at a reverse proxy
-([see below](#reverse-proxying)) so you can share certificates with Headscale
-and other services. Built-in TLS is meant for the simpler "Headplane on a
-single box" scenarios.
-
-The bundled Docker healthcheck picks up the right scheme and port
-automatically — Headplane writes its loopback URL to `/tmp/headplane-listen`
-when it starts, and the healthcheck reads it from there. No extra environment
-variables, no duplicated config.
+Anything to do with TLS — terminating HTTPS in-process, trusting a private
+CA for outbound connections to Headscale or your OIDC provider, the
+interaction with `cookie_secure` and the Docker healthcheck — lives on its
+own page: [TLS & Certificates](./tls).
 
 ## Reverse Proxying