Tasks

1. Serve the certificate for the connecting address

1.1 Add a helper that lists the container's local addresses (IPv4 and IPv6, loopback excluded) using hostname -I, falling back to ip -o addr; verify the logic with a stubbed hostname/getent (IPv4 only, IPv6 only, address containing a %zone, and no addresses at all)
1.2 Add a helper that mangles a name the way http_make_path() in CUPS does (keep [A-Za-z0-9.-], replace the rest with _) and derive the lookup names: every DNS SAN, each address literal with %zone spelled +zone, and each address's reverse-resolved name (getent hosts)
1.3 Rewrite install_default_cert_copy() to install <name>.crt/<name>.key for all those names, preserving the 0644/0640 root:lp permissions; verify with a stubbed environment that the copies include host.containers.internal.crt, podp.local.crt and <ipv6-literal>.crt
1.4 After rebuilding and redeploying on the podman host, verify from another host that curl https://podp.local:631/ succeeds and openssl s_client -connect <LAN address>:631 -servername podp.local shows our certificate (SANs contain the advertised name), not CN=host.containers.internal

2.1 Correct the certificate comments in entrypoint.sh: CUPS 2.4 ignores ServerCertificate/ServerKey, selects the certificate by the connection's local address and mangles the name with http_make_path()
2.2 Update the README certificate section to describe how CUPS selects the certificate and why the per-name copies exist
2.3 Add a scenario to the printserver/cups spec covering the certificate served for the address a client connected to

Archive this change (/opsx-archive) so the delta merges into openspec/specs/printserver/cups/spec.md.
Commit the implementation together with the archived change using jj.