Remove self-signed TLS option (system trust only); add session changelog

Parity with the Android client: drop the "Allow self-signed certificate"
escape hatch. The app now performs system TLS trust only — a self-signed
appliance must have its CA installed on the device (MDM/profile). A code-only
public-key pinning policy remains (no UI).

- ServerTrustEvaluator: remove ServerTrustPolicy.allowSelfSignedForHost and its
  challenge handler; keep .system (default) and .pinPublicKeySHA256.
- SettingsView: remove the self-signed toggle/state/prefill; makeConfig uses
  the default .system policy.
- MCMSConnection / APIConfiguration: update usage-sketch + doc comments.
- README / GUI-NOTES / MCMS_API.md: document system-trust-only; self-signed
  boxes need their CA installed on the device.
- Add CHANGELOG.md for this session, flagged for the Android port.

Note: configs previously persisted with the self-signed policy fail to decode
and reset to defaults (one-time re-entry of the server URL).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

GUI-NOTES.md

@@ -9,7 +9,7 @@ a working skeleton you run against a live MCMS box, then refine.
 App/         MCMSMobileApp (@main), RootView routing, AppEnvironment
 UI/          Shared components (badges, count tiles, load/error states, LoadPhase)
 Features/
-  Settings/  Connection config + test (direct or proxy, self-signed toggle)
+  Settings/  Connection config + test (direct or proxy; system TLS trust only)
   Login/     Email/password, Keychain prefill
   Dashboard/ Device + alarm counts (VM + View)
   ONUList/   Searchable ONU list (VM + View)
@@ -39,11 +39,12 @@ reinstate a `ContentUnavailableView` shim.
 
 ## App Transport Security (the gotcha)
 
-TLS *trust* for self-signed certs is handled in code by `ServerTrustEvaluator`,
-but **ATS is separate** and can still block the connection:
+TLS uses **system trust only** — there is no self-signed bypass. (Historical note:
+an earlier build had a `ServerTrustEvaluator` self-signed toggle; it was removed for
+parity with Android.) ATS is separate and can still block the connection:
 
-- **HTTPS to a self-signed host:** the trust delegate covers it; no Info.plist
-  change needed for cert validation itself. (Keep TLS 1.2+.)
+- **HTTPS to a self-signed host:** the connection FAILS unless the host's CA is
+  installed on the device (MDM/configuration profile). Keep TLS 1.2+.
 - **Plain HTTP** (no TLS) or weak TLS: ATS blocks it by default. Add a *scoped*
   exception for your host in Info.plist rather than a blanket allow: