docs: README with badges, better copy, landing link

Author: ArpitRajputGithub

README.md

@@ -1,6 +1,22 @@
+<div align="center">
+
 # httpsdev
 
-**Zero-config HTTPS for any local dev server.**
+**Localhost with a working padlock.**
+
+Point it at a port. Get a green padlock.
+
+[![Release](https://img.shields.io/github/v/release/ArpitRajputGithub/httpsdev?style=flat-square&color=cba6f7&labelColor=1e1e2e)](https://github.com/ArpitRajputGithub/httpsdev/releases)
+[![Go Reference](https://img.shields.io/badge/go-reference-cba6f7?style=flat-square&labelColor=1e1e2e)](https://pkg.go.dev/github.com/ArpitRajputGithub/httpsdev)
+[![License](https://img.shields.io/badge/license-MIT-cba6f7?style=flat-square&labelColor=1e1e2e)](LICENSE)
+[![CI](https://img.shields.io/github/actions/workflow/status/ArpitRajputGithub/httpsdev/ci.yml?style=flat-square&labelColor=1e1e2e&color=a6e3a1)](https://github.com/ArpitRajputGithub/httpsdev/actions)
+
+<!-- Swap this for a real GIF after `vhs demo.tape` runs. See demo.tape. -->
+<!-- <img src=".github/demo.gif" alt="httpsdev demo" width="720" /> -->
+
+</div>
+
+---
 
 ```
 $ mkcert -install       # one time, system-wide
@@ -11,7 +27,13 @@ Real browser-trusted cert. Works with Vite, Next, Rails, Django, Flask — any H
 
 ## Why
 
-Every framework has its own HTTPS story (`--https`, `HTTPS=true`, experimental configs) and most default to self-signed certs that trip browser warnings, break service workers, and blow up OAuth callbacks. `httpsdev` sits in front of your existing dev server and gives it real HTTPS in one command.
+Every framework has its own broken HTTPS story. Some ship self-signed certs that trip the browser. Some hide it behind an `HTTPS=true` env var. Some just don't. `httpsdev` sits in front of any dev server and hands it a real, browser-trusted cert — the kind that comes from mkcert's local CA, so Chrome and Safari already trust it.
+
+Specifically fixes:
+- Service workers refusing to register over `http://`
+- OAuth callbacks rejecting non-HTTPS redirect URIs (Google, GitHub, Auth0)
+- `Secure` / `SameSite=None` / `__Host-` cookies not surviving the round-trip
+- WebAuthn, Web Crypto, clipboard, camera/mic APIs gated behind secure context
 
 ## Install
 
@@ -25,12 +47,13 @@ mkcert -install
 Then:
 
 ```bash
-# Homebrew (coming in v0.2)
-
-# Go install
+# Go install (Go users)
 go install github.com/ArpitRajputGithub/httpsdev@latest
 
-# Or grab a binary from Releases:
+# Homebrew (coming in v0.2)
+# brew install ArpitRajputGithub/tap/httpsdev
+
+# Or grab a prebuilt binary from Releases:
 #   https://github.com/ArpitRajputGithub/httpsdev/releases
 ```
 
@@ -70,9 +93,7 @@ POST  /api/login            401   45ms
 httpsdev --tui 5173
 ```
 
-Full-screen Catppuccin Mocha TUI with live request feed, latency stats, and cert info tab.
-
-*(GIF placeholder — record with asciinema after v0.1 tag)*
+Full-screen Catppuccin Mocha TUI with live request feed, latency stats, and connection info. The wordmark alone justifies the download.
 
 ### Test on your phone
 
@@ -88,7 +109,11 @@ Binds on `0.0.0.0`. Your phone (on the same wifi) can hit `https://<mac-ip>:3443
 - Multi-service reverse proxy (`api.dev.local`, `web.dev.local`) — use [Caddy](https://caddyserver.com) for that.
 - Framework detection.
 
-All tracked as issues for v0.2+.
+All tracked as [issues](https://github.com/ArpitRajputGithub/httpsdev/issues) for v0.2+.
+
+## Website
+
+<https://httpsdev.pages.dev> — landing page with a live TUI preview.
 
 ## License