Ah, the other thing I didn't mention is that it works OK from WiFi, but not when accessed from outside the LAN.
The browser says "This site can't provide a secure connection. brettward.duckdns.org send an invalid response". The app says various things on different days, some of them explicitly about a certificate error, others lots longer and more complicated.
No certificate called ISRG Root X1 is listed as either System or User "security certificates". My attempt to install it manually doesn't show up in either of these lists, but does show up in "User certificates" (apparently something different to "User security certificates").
So ... a problem with recognising the root certificate is just the latest theory in a long list of things investigated.
And ... I've just realised ... the person whose phone worked might have been connected to my WiFi, I need to check that. If he was then there may not be a difference between his phone and mine.