For most of my internal services that are sitting behind Traefik I use step-ca which basically gives you a Let’s Encrypt style certificate while working over the local network. The root CA has a long expiry (so might not be what you want if your goal Is a short lived root CA) but the actual certificates for each service are short lived (a touch over 24 hours from memory?)
An Apple TV actually fits this use case pretty well. Being Apple most providers will have native apps available for the device (they definitely have Netflix, Prime Video and Disney+), it comes with a remote but supports using other infrared remotes (you can train it to recognise specific buttons so doesn’t matter what remote you use), and you can also control it from your phone (it works natively for iOS but there are Android apps that can do it too).
For casting, if you use Apple devices it’s easy with AirPlay. If you use Android devices there are apps you can get that support Chromecast, however haven’t ever used them personally so can’t comment on their effectiveness.
And to date Apple haven’t put ads into the tvOS interface. It’s basically a grid of apps and you just open the one you want to watch. It’s been our primary TV device for years now, and is simple enough to use that even my 60 something tech adverse mum likes using it.