docs: require well-known CA-signed TLS certs for enterprise install

enterprise/quick-start.mdx

@@ -126,8 +126,10 @@
     | `runtime-api.<your-domain>` | `runtime-api.openhands.example.com` |
     | `*.runtime.<your-domain>` | `*.runtime.openhands.example.com` |
 
-    **Obtain a TLS certificate** with SANs (Subject Alternative Names) for all of the above domains,
-    then copy the certificate (`.pem` or `.crt`) and private key (`.pem` or `.key`) to the VM.
+    **Obtain a TLS certificate signed by a well-known certificate authority (CA) such as Let's Encrypt**, with SANs
+    (Subject Alternative Names) for all of the above domains, then copy the certificate
+    (`.pem` or `.crt`) and private key (`.pem` or `.key`) to the VM. Self-signed certificates
+    are not supported for the OpenHands application.
 
     <Warning>
       If you don't provide TLS certificates during installation, the Admin Console will use a
@@ -173,9 +175,9 @@
 done
 ```
 
 Expected: each hostname above resolves to your VM's public IP address.
 
 Test that a runtime wildcard hostname resolves:
 
 ```bash
 getent hosts "test.runtime.${BASE_DOMAIN}" || nslookup "test.runtime.${BASE_DOMAIN}"
@@ -210,7 +212,7 @@
 done
 ```
 
 Any HTTP response code other than `000` is acceptable for reachability checks
 (for example `200`, `301`, `302`, `401`, `403`, `405`).
 
 If any check fails, stop and resolve before continuing:
@@ -221,10 +223,10 @@
 
 | Requirement | Why It Exists |
 |------------|----------------|
 | `443/TCP` inbound | Primary HTTPS entrypoint for users and service hostnames |
 | `30000/TCP` inbound | Replicated/KOTS Admin Console for install and configuration |
 | `80/TCP` inbound | HTTP entrypoint used for ingress/redirect behavior |
 | `*.runtime.<domain>` DNS + cert SAN | Runtime sandboxes are addressed by dynamic runtime-specific hostnames |
 | `replicated.app`, `proxy.replicated.com` | Replicated control-plane/license/install paths |
 | `images.r9...`, `charts.r9...`, `updates.r9...`, `install.r9...` | Vendor distribution image/chart/update/install endpoints |
 | `traefik.github.io` | Embedded cluster ingress chart repository |
@@ -290,7 +292,7 @@
 ### 5. Upload TLS certificate (if not provided with the install command)
 
 If you did not provide certificates with the `install` command, select **"Upload your own"**,
 enter your base domain under **Hostname**, upload your private key and SSL certificate, then click **Continue**.
 
 ![Upload TLS certificate](./images/upload-tls-certificate.png)
 
@@ -315,7 +317,7 @@
 
 ### Domain Configuration
 
 - Select **"Derive hostnames from domain (recommended)"**
 - Enter your base domain (e.g., `openhands.example.com`)
 
 ### Certificate Configuration