--tls generates a self-signed cert (SANs: localhost, 127.0.0.1, LAN IP) so a headless box is reachable directly over HTTPS, which browsers treat as a secure context (required for cross-origin isolation). make web now defaults to TLS.