fix: sync actual TLS state to ConfigStore on console startup (#258)

* fix: sync actual TLS state to ConfigStore on console startup

The console writes tls.enabled to the DB but never clears it when TLS
init fails or isn't configured.  Server nodes read the stale DB value
and attempt TLS negotiation with a non-TLS console, producing noisy
SSL errors on every startup.

Console now syncs the actual TLS state after init: if TLS succeeded,
tls.enabled=true; if it failed or wasn't attempted, tls.enabled=false.
Server TLS failure log reduced from full traceback to one-line warning.

* fix: sync TLS state to ConfigStore on console startup

Console now writes the definitive TLS state to ConfigStore so server
nodes don't attempt TLS against a non-TLS console:

- TLS init succeeded → write true
- TLS not configured (DB false/unset) → write false (definitive)
- TLS configured (DB true) but init failed → don't overwrite
  (transient failure shouldn't permanently disable)

Server TLS warning reduced to one line with exception type, full
traceback available at debug level.

turnstone/console/server.py

@@ -5869,8 +5869,31 @@ def main() -> None:
                 log.info("TLS enabled")
         except ImportError:
             log.warning("TLS enabled but lacme not installed — pip install turnstone[tls]")
+            tls_mgr = None
         except Exception:
             log.warning("TLS initialization failed", exc_info=True)
+            tls_mgr = None
+
+        # Sync TLS state to ConfigStore so server nodes see the correct value.
+        # Three cases:
+        # 1. TLS succeeded → write true
+        # 2. TLS not configured (DB false/unset) → write false (definitive)
+        # 3. TLS configured (DB true) but init failed → don't overwrite
+        #    (transient failure shouldn't permanently disable TLS)
+        try:
+            db_enabled = _cs.get("tls.enabled")
+            if tls_mgr is not None:
+                if not db_enabled:
+                    _cs.set("tls.enabled", True, changed_by="console-startup")
+            elif db_enabled:
+                log.warning(
+                    "tls.enabled is true in ConfigStore but TLS init failed — "
+                    "server nodes will attempt TLS and fall back to plain HTTP"
+                )
+            else:
+                _cs.set("tls.enabled", False, changed_by="console-startup")
+        except Exception:
+            log.debug("Failed to sync TLS state to ConfigStore", exc_info=True)
 
     app = create_app(
         collector=collector,

turnstone/server.py

@@ -2800,8 +2800,13 @@ def main() -> None:
                 log.info("TLS enabled — serving HTTPS")
             else:
                 log.warning("TLS enabled but no cert available")
-        except Exception:
-            log.warning("TLS initialization failed — serving plain HTTP", exc_info=True)
+        except Exception as exc:
+            log.warning(
+                "TLS initialization failed — serving plain HTTP: %s: %s",
+                type(exc).__name__,
+                exc,
+            )
+            log.debug("TLS init traceback", exc_info=True)
 
     print("Press Ctrl+C to stop.")