feat(tsconnect): add getCert, listenTLS, setFunnel + fix TLS cert for WASM

Enable ACME TLS certificates on js/wasm by dropping the !js build tag from
cert.go and routing storage through the state store. Add getCert, listenTLS,
and setFunnel WASM bindings with a combinedTLSListener that merges Funnel
ingress and direct tailnet connections. Notify the control plane immediately
after serve config changes to accelerate Funnel DNS provisioning.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

feature/acme/certstore.go

@@ -82,6 +82,10 @@ func certDir(b *ipnlocal.LocalBackend) (string, error) {
 
 func (e *extension) getCertStore(b *ipnlocal.LocalBackend) (certStore, error) {
 	st := b.Sys().StateStore.Get()
+	if runtime.GOOS == "js" {
+		// No filesystem to hold a cert directory; the state store is all we have.
+		return certStateStore{StateStore: st}, nil
+	}
 	switch st.(type) {
 	case *store.FileStore:
 	case *mem.Store:
@@ -396,10 +400,14 @@ func (e *extension) acmeClient(cs certStore) (*xacme.Client, error) {
 	// Note: if we add support for additional ACME providers (other than
 	// LetsEncrypt), we should make sure that they support ARI extension (see
 	// shouldStartDomainRenewalARI).
+	e.mu.Lock()
+	httpClient := e.httpClient
+	e.mu.Unlock()
 	return &xacme.Client{
 		Key:          key,
 		UserAgent:    "tailscaled/" + version.Long(),
 		DirectoryURL: envknob.String("TS_DEBUG_ACME_DIRECTORY_URL"),
+		HTTPClient:   httpClient,
 	}, nil
 }