[Subtask] M4: Convenience helpers for common TLS setups

### Describe the subtask

The ergonomics milestone. After M3, every journey is possible; this makes the
common ones short. A user configuring the standard cases — trust an internal CA,
present a client certificate — should not need to know what an `SSLContext` is.

## Deliverable

Helper methods on the configurer factory for the common paths, so the typical
call site shrinks to one line per concern (a truststore, a keystore) with
sensible defaults for everything else — store type, hostname verification,
context algorithm.

The discipline: every helper must map to a journey named in the design doc.
Convenience surface is still public surface — we maintain it forever — so no
speculative methods "while we're in there." If a helper seems useful but has no
CUJ behind it, that's a design-doc amendment first.

## Acceptance criteria

- [ ] The private-CA and mutual-TLS journeys are expressible without touching
`SSLContext`, `KeyStore`, or any JSSE type directly
- [ ] Every helper corresponds to a CUJ in the design doc
- [ ] Docs examples updated to the shortened form
- [ ] Tests for each helper, including failure messages on bad input

Depends on: M3.

### Parent issue

#9836

Start with the M3 implementation and the design doc's named private-CA and mutual-TLS journeys, then locate the configurer factory. Verify which helpers and defaults those journeys require, update the docs examples, and add tests for each helper, including bad-input failure messages. Done means both journeys avoid direct JSSE types and every helper maps to a documented CUJ.

Written by the indexing model from the issue text.