🐞 Bug Summary

SSL certificates with passphrase-protected private keys fail to load, causing the MCP Gateway server to crash on startup when attempting to use HTTPS with encrypted keys.

🔁 Steps to Reproduce

1. Generate a passphrase-protected SSL certificate:

# 1. Generate private key protected by a passphrase
openssl genrsa -aes256 -out mysite.key 2048

# 2. Generate a self-signed certificate (will ask for key passphrase)
openssl req -new -x509 -key mysite.key -out mysite.crt -days 365

2. Attempt to start the server with the encrypted key:

SSL=true CERT_FILE=certs/cert.pem KEY_FILE=certs/key-encrypted.pem make serve-ssl
# or use docker-compose.yml with SSL=true

3. Observe the server crash with an error about being unable to load the private key

🤔 Expected Behavior

The server should support both passphrase-protected and regular (unencrypted) SSL certificates. Users should be able to provide a passphrase via environment variable (e.g., KEY_FILE_PASSWORD) to decrypt and use passphrase-protected keys for HTTPS configuration in both production (Gunicorn) and development (Uvicorn) environments.

💡 Proposed Solution

Implement SSL key manager utility that:

1. Detects if a passphrase is provided via KEY_FILE_PASSWORD environment variable
2. Decrypts the passphrase-protected key to a secure temporary file (0o600 permissions)
3. Passes the decrypted key to Gunicorn/Uvicorn
4. Automatically cleans up temporary files on process exit
5. Maintains full backward compatibility with unencrypted keys

📓 Logs / Error Output

Paste any relevant stack traces or logs here.
⚠️ Do not paste secrets, credentials, or tokens.

🧠 Environment Info

You can retrieve most of this from the /version endpoint.

🧩 Additional Context (optional)

Add any configuration details, flags, or related issues.