Add dual-port TLS support for FQDN access

When ALSO_LISTEN_PORT is set (e.g., 443), the server binds to both
the primary PORT (3001) and the additional port using the same TLS
certs. This enables clean FQDN access (https://aegis-uat.charterlab.com)
on port 443 while keeping the existing IP:3001 URL working as a
fallback during the DNS transition period.

backend/server.js

@@ -1245,11 +1245,20 @@ if (TLS_ENABLED) {
         cert: fs.readFileSync(TLS_CERT),
         key: fs.readFileSync(TLS_KEY),
     };
-    https.createServer(httpsOptions, app).listen(PORT, () => {
+    const server = https.createServer(httpsOptions, app);
+    server.listen(PORT, () => {
         console.log(`CVE API server running on https://${API_HOST}:${PORT}`);
         console.log(`TLS: enabled (cert: ${TLS_CERT})`);
         console.log(`CORS origins: ${CORS_ORIGINS.join(', ')}`);
     });
+
+    // Also listen on port 443 if PORT is not already 443 — enables clean FQDN access
+    const ALSO_LISTEN = parseInt(process.env.ALSO_LISTEN_PORT || '0', 10);
+    if (ALSO_LISTEN && ALSO_LISTEN !== parseInt(PORT, 10)) {
+        https.createServer(httpsOptions, app).listen(ALSO_LISTEN, () => {
+            console.log(`TLS: also listening on port ${ALSO_LISTEN}`);
+        });
+    }
 } else {
     app.listen(PORT, () => {
         console.log(`CVE API server running on http://${API_HOST}:${PORT}`);