Add HTTPS demo entry for microphone access

- Add a self-signed HTTPS Nginx entrypoint on Docker port 4443 so browser microphone APIs can run in demo mode.

- Keep the existing HTTP port 4002 unchanged while exposing container port 443 and generating the demo certificate during image build.

- Update CORS defaults and Compose environment for the HTTPS frontend origin.

- Clarify the report editor microphone message with localhost, HTTPS, and browser trusted-origin demo options.

- Document the browser HTTP microphone limitation, HTTPS demo URL, and Chrome/Edge insecure-origin workaround in README and docs.

AGENTS.md

@@ -309,6 +309,8 @@ npm run test:e2e
 
 API 默认 JSON/urlencoded 请求体上限为 `100mb`，由 `API_BODY_LIMIT` 控制；Nginx 同步配置了 `client_max_body_size 100m`，用于承载迁移期报告 HTML、图片/关键帧和通用文件 Data URL 上传。
 
+Docker 前端默认暴露 `http://localhost:4002`，并额外暴露自签名 HTTPS 演示入口 `https://localhost:4443`。浏览器麦克风 API 不能在普通局域网 HTTP 页面中由应用代码强行开启；语音听写演示优先使用 HTTPS 入口，或用 Chrome/Edge 的 `--unsafely-treat-insecure-origin-as-secure` 临时标记 HTTP 来源。
+
 ### `server/prisma/schema.prisma`
 
 PostgreSQL 数据模型。当前覆盖 `Tenant`、`Department`、`User`、`UserSession`、`AppSession`、`Report`、`ReportMedia`、`ReportHistory`、`Template`、模板部门授权、`FileResource`、`SystemSetting` 和 `AuditLog`。Prisma 7 连接配置在根目录 `prisma.config.ts` 中。