Remove self-signed TLS option (system trust only); add session changelog

Parity with the Android client: drop the "Allow self-signed certificate"
escape hatch. The app now performs system TLS trust only — a self-signed
appliance must have its CA installed on the device (MDM/profile). A code-only
public-key pinning policy remains (no UI).

- ServerTrustEvaluator: remove ServerTrustPolicy.allowSelfSignedForHost and its
  challenge handler; keep .system (default) and .pinPublicKeySHA256.
- SettingsView: remove the self-signed toggle/state/prefill; makeConfig uses
  the default .system policy.
- MCMSConnection / APIConfiguration: update usage-sketch + doc comments.
- README / GUI-NOTES / MCMS_API.md: document system-trust-only; self-signed
  boxes need their CA installed on the device.
- Add CHANGELOG.md for this session, flagged for the Android port.

Note: configs previously persisted with the self-signed policy fail to decode
and reset to defaults (one-time re-entry of the server URL).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

MCMS_API.md

@@ -652,10 +652,10 @@ is between −28 and −30 dBm.
   HTTPCookieStorage.shared.cookies(for: baseURL)?
     .first { $0.name == "__Host-csrftoken" || $0.name == "csrftoken" }?.value
   ```
-- **Self-signed certs**: Implement
-  `URLSessionDelegate.urlSession(_:didReceive:completionHandler:)`
-  and accept `serverTrust` only when the user has explicitly toggled
-  "accept self-signed" for the configured host. Never default-on.
+- **Self-signed certs**: NOT accepted in-app — both clients use system trust only,
+  with no "accept self-signed" bypass. A self-signed appliance must have its CA
+  installed on the device's OS trust store (MDM/configuration profile). Do not
+  add a trust-bypass toggle.
 - **JSON**: `JSONSerialization` is simpler than `Codable` for the
   envelope pattern (`{status, data, details}`) because the `data`
   payload is heterogeneous. `Codable` works if you model each
@@ -700,11 +700,14 @@ MCMS APIs are typically reachable only from the operator's internal
 network. Test on cellular: many internal hosts won't be reachable,
 and your error UI needs to communicate that clearly.
 
-### 8.7 Self-signed cert prompt
+### 8.7 Self-signed certs → install the CA
 
-Make this a first-class onboarding step. The lab MCMS at
-`https://mcms.lab.svorka.net/` uses a self-signed cert, and any
-auto-rejection will silently break login.
+There is no in-app "accept self-signed" prompt (removed for iOS/Android parity).
+The lab MCMS at `https://mcms.lab.svorka.net/` uses a self-signed cert, so it is
+unreachable until that CA is installed on the device's OS trust store
+(MDM/configuration profile) — or the box is given a CA-trusted cert. Surface the
+resulting trust failure clearly in the error UI so it doesn't look like a silent
+login break.
 
 ---