Description

When using make compose-tls with a passphrase-protected private key, nginx fails to start because it cannot read encrypted keys natively.

Steps to Reproduce

1. Generate a passphrase-protected certificate:

   make certs-passphrase

2. Run the TLS profile:

   make compose-tls

3. nginx fails with SSL error - unable to read private key

Expected Behavior

Users should be able to use passphrase-protected certificates by providing the passphrase via environment variable.

Actual Behavior

nginx cannot start because it doesn't support passphrase-protected keys without additional configuration.

Environment

• Docker Compose with TLS profile
• Any passphrase-protected PEM key

Proposed Solution

Enhance cert_init service to:

1. Detect key-encrypted.pem file
2. Read passphrase from KEY_FILE_PASSWORD env var
3. Decrypt key to key.pem before nginx starts