docs(#69): two-port + autocert TLS quickstart, drop nginx from default path

- quickstart \u00a75: replace 'nginx in front terminating TLS' with the
  built-in two-port + --public-tls-domain autocert flow; keep the
  'already running nginx' case as a tip.
- cli.md: document --admin-listen / --public-listen / --public-tls-domain
  / --acme-http-listen / --acme-directory-url; mark --listen deprecated.
- architecture.md: TLS terminated in-process, no reverse proxy needed by
  default.

Docs site builds clean (vitepress); auto-deploys to curio-core-docs.pages.dev.

Author: Reiers

docs/concepts/architecture.md

@@ -57,7 +57,11 @@ Everything inside the box is in one process. The only external dependencies are:
 
 - the Filecoin chain itself (via Lantern's libp2p peers + the FEVM bridge upstream)
 - the local filesystem (state DB + piece bytes)
-- (optionally) an nginx reverse proxy in front for TLS + path filtering
+
+TLS is terminated in-process via baked-in `autocert` (the two-port model, see
+[Quickstart §5](/getting-started/quickstart)), so no nginx / reverse proxy is needed in
+the default deploy. Operators who already run nginx for other services can still front a
+plaintext `--public-listen` loopback port if they prefer.
 
 ## Key seams
 

docs/getting-started/quickstart.md

@@ -74,14 +74,42 @@ You should see:
 
 ## 5. (Optional) Wire to a public hostname
 
-If you want this SP to receive client traffic, you need:
-
-1. A public DNS name (`sp.example.com`) pointing at the box.
-2. nginx in front terminating TLS, proxying to `127.0.0.1:14994`. Important: forward
-   only `/pdp/*`, `/piece/*`, and `/.well-known/*` to the public side. **Never** expose
-   `/admin/*` or `/`/dashboard paths.
-3. The service registered on the Filecoin **Service Registry** so clients can discover
-   you (see [Operate → Registration](/operating/dashboard)).
+curio-core terminates TLS itself — **no nginx required**. It runs a two-port model:
+
+- **Admin port** (`--admin-listen`, default `127.0.0.1:14994`): dashboard, `/setup`,
+  `/admin/*`. Loopback-only; never exposed publicly.
+- **Public port** (`--public-listen`): `/pdp/*` + `/piece/*`. Gets a LetsEncrypt cert
+  automatically via baked-in [`autocert`](https://pkg.go.dev/golang.org/x/crypto/acme/autocert).
+
+To receive client traffic:
+
+1. Point a public DNS name (`sp.example.com`) at the box.
+2. Open ports **80** (ACME HTTP-01 challenge) and **443** (HTTPS).
+3. Start with the public surface enabled:
+
+```bash
+curio-core run \
+  --data-dir /var/lib/curio-core \
+  --network calibration \
+  --admin-listen 127.0.0.1:14994 \
+  --public-listen 0.0.0.0:443 \
+  --public-tls-domain sp.example.com
+```
+
+On first boot curio-core provisions a cert from LetsEncrypt and serves valid TLS within
+~30s. The cert + ACME account state persist in the `autocert_cache` SQLite table, so
+restarts never trigger a fresh ACME round-trip. The `/admin/*` and dashboard surfaces
+stay on the loopback admin port and are never reachable from the public internet.
+
+4. Register the service on the Filecoin **Service Registry** so clients can discover you
+   (see [Operate → Registration](/operating/dashboard)).
+
+::: tip Already running nginx for other services?
+Point the public surface at a loopback port and proxy to it:
+`--public-listen 127.0.0.1:14995` (plaintext, no `--public-tls-domain`), then terminate
+TLS in your existing nginx and forward only `/pdp/*` + `/piece/*`. Never proxy `/admin/*`
+or `/`.
+:::
 
 ## What's next
 

docs/reference/cli.md

@@ -20,7 +20,12 @@ Flags:
 |---|---|---|
 | `--data-dir` | `~/.curio-core` | Persistent state directory (SQLite + Lantern + stash) |
 | `--network` | (from build) | `calibration` or `mainnet` |
-| `--listen` | `127.0.0.1:14994` | HTTP listen address |
+| `--listen` | `127.0.0.1:14994` | Deprecated alias for `--admin-listen` |
+| `--admin-listen` | (falls back to `--listen`) | Loopback admin/UI surface: dashboard, `/setup`, `/admin/*` |
+| `--public-listen` | (empty = single-port) | Public surface: `/pdp/*` + `/piece/*`. Empty keeps everything on the admin port |
+| `--public-tls-domain` | (empty) | Domain for baked-in `autocert` TLS on the public port. Empty serves plaintext (dev) and refuses `:443` |
+| `--acme-http-listen` | `:80` | ACME HTTP-01 challenge + HTTP→HTTPS redirect bind (only with `--public-tls-domain`) |
+| `--acme-directory-url` | (empty) | Override ACME directory (LetsEncrypt staging / tests) |
 | `--vm-bridge-rpc` | per-network default | Upstream Filecoin RPC for FEVM operations |
 | `--vm-bridge-rpc-disable` | false | Disable the FEVM bridge entirely (offline-only mode) |
 | `--engine-cpu` | 4 | harmonytask CPU budget |