App Role guide update.

Documents issuing both client and server certificates. WIF relies on
client certificates.

Server example documents an example of internal Web service using an
autorenewing internal certificate.

web-test/Caddyfile

@@ -0,0 +1,5 @@
+:443 {
+	tls /etc/caddy/server_cert.pem /etc/caddy/server_key.pem
+	root * /var/www/web-test
+	file_server
+}

web-test/caddy-hook.sh

@@ -0,0 +1,6 @@
+#!/bin/bash
+set -euo pipefail
+
+install -m 0644 -o root -g root "${CERT_FILE}" /etc/caddy/server_cert.pem
+install -m 0640 -o root -g caddy "${KEY_FILE}" /etc/caddy/server_key.pem
+systemctl reload-or-restart caddy.service

web-test/index.html

@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>Hook test</title>
+  <script src="https://cdn.jsdelivr.net/npm/@tailwindcss/browser@4"></script>
+</head>
+<body class="min-h-screen bg-slate-100 flex items-center justify-center">
+  <main class="max-w-md rounded-xl bg-white p-8 shadow-lg">
+    <h1 class="text-3xl font-bold text-slate-900">Hook test</h1>
+    <p class="mt-4 text-slate-600">This page is served over TLS with the certificate managed by the renewal service.</p>
+  </main>
+</body>
+</html>