Cleanup before network implementation

Makefile

@@ -8,7 +8,7 @@
 #    make clean       — remove generated outputs
 # ============================================================
 
-.PHONY: render preview build build-cm5 clean
+.PHONY: render preview build build-cm5 clean certs
 
 VENV        := $(HOME)/.venv/quic_ecs
 PYTHON      := $(VENV)/bin/python
@@ -16,6 +16,22 @@ CM5_HOST    ?= 192.168.1.x
 CM5_USER    ?= pi
 CM5_BIN_DIR ?= /home/pi/quic_ecs_dt
 
+# Self-signed dev TLS for the QUIC server (regenerate with `make certs`).
+# SAN covers loopback, ::1, and cm5.local for the two-machine setup.
+CERT_DIR  := certs
+CERT_FILE := $(CERT_DIR)/server.crt
+KEY_FILE  := $(CERT_DIR)/server.key
+
+certs: $(CERT_FILE)
+
+$(CERT_FILE):
+	mkdir -p $(CERT_DIR)
+	openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:P-256 \
+	    -keyout $(KEY_FILE) -out $(CERT_FILE) \
+	    -days 3650 -nodes \
+	    -subj "/CN=localhost/O=quic_ecs_dt-dev/OU=substrate" \
+	    -addext "subjectAltName=DNS:localhost,DNS:cm5.local,IP:127.0.0.1,IP:::1"
+
 # Paper
 render:
 	cd paper && quarto render index.qmd
@@ -23,11 +39,11 @@ render:
 preview:
 	cd paper && quarto preview index.qmd --port 4848 --no-browser
 
-# Rust build
-build:
+# Rust build (depends on dev cert so `cargo run` boots out of the box)
+build: $(CERT_FILE)
 	cargo build --release
 
-build-cm5:
+build-cm5: $(CERT_FILE)
 	CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER=aarch64-linux-gnu-gcc \
 	cargo build --release --target aarch64-unknown-linux-gnu