docs: rewrite certificate setup guide

[rsubrama83]

Addresses #26.

Why

The certificate setup guide (docs/setup/certificate.md) relied on certbot's HTTP-01 challenge through an ngrok tunnel. That fails with a 404 from acme.ngrok.com (reported in #26). The guide also had several dead links and wrong paths.

Changes

• Explain what the bot needs: a machine it can run on that is reachable from the internet, a domain you control, and a publicly trusted cert for exactly AzureSettings__ServiceDnsName in LocalMachine\My. An *.ngrok.io cert does not work for media.
• Replace the host.sh / HTTP-01 flow with certbot's DNS-01 challenge, plus a tip on certbot DNS plugins so renewal can run unattended.
• Export the PFX with fullchain.pem so the intermediate certificates are included.
• Install with Import-PfxCertificate. The MMC steps are kept as a collapsed alternative.
• Show the .env values to set and the startup error you get for a wrong thumbprint. Fix the certs.bat path (scripts/, not build/).
• Add sections on renewal (the thumbprint changes) and troubleshooting, including "bot never receives POST /api/calling" (the last open question in Docs for certificates are bad #26).
• Point AKS users to the cert-manager docs.
• Fix dead links: the link to Microsoft's old repo, a broken anchor, the missing ngrok.yaml and .devcontainer references, and policy.md (it lives in docs/guides/). Update the step titles in README.md and docs/setup/readme.md.

Open points

• The certs.bat netsh bindings step is kept as before. Kestrel loads the cert itself for the signaling port, so the binding may only be needed for the media port, or not at all on the 2025.x media stack. Please confirm before we make it optional.
• No doc references scripts/host.sh, config.ini or config.sh (or their templates) anymore. They could be removed in a follow-up, along with one of the two duplicate ngrok templates.
• I haven't tested the new guide end to end.

🤖 Generated with Claude Code