Remove self-signed TLS option (system trust only); add session changelog

Parity with the Android client: drop the "Allow self-signed certificate"
escape hatch. The app now performs system TLS trust only — a self-signed
appliance must have its CA installed on the device (MDM/profile). A code-only
public-key pinning policy remains (no UI).

- ServerTrustEvaluator: remove ServerTrustPolicy.allowSelfSignedForHost and its
  challenge handler; keep .system (default) and .pinPublicKeySHA256.
- SettingsView: remove the self-signed toggle/state/prefill; makeConfig uses
  the default .system policy.
- MCMSConnection / APIConfiguration: update usage-sketch + doc comments.
- README / GUI-NOTES / MCMS_API.md: document system-trust-only; self-signed
  boxes need their CA installed on the device.
- Add CHANGELOG.md for this session, flagged for the Android port.

Note: configs previously persisted with the self-signed policy fail to decode
and reset to defaults (one-time re-entry of the server URL).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

APIConfiguration.swift

@@ -37,8 +37,9 @@ struct APIConfiguration: Equatable, Codable {
     var sessionCookieName: String = "sessionid"
     var csrfCookieName: String = "csrftoken"
 
-    /// How to treat the server's TLS certificate. These boxes typically present
-    /// a self-signed / internal-CA cert. See `ServerTrustEvaluator`.
+    /// How to treat the server's TLS certificate. Defaults to system trust; the
+    /// app has no self-signed bypass, so a self-signed box needs its CA installed
+    /// on the device (MDM/profile). See `ServerTrustEvaluator`.
     var trustPolicy: ServerTrustPolicy = .system
 
     /// Request timeout (seconds).