Remove self-signed TLS option (system trust only); add session changelog

Parity with the Android client: drop the "Allow self-signed certificate"
escape hatch. The app now performs system TLS trust only — a self-signed
appliance must have its CA installed on the device (MDM/profile). A code-only
public-key pinning policy remains (no UI).

- ServerTrustEvaluator: remove ServerTrustPolicy.allowSelfSignedForHost and its
  challenge handler; keep .system (default) and .pinPublicKeySHA256.
- SettingsView: remove the self-signed toggle/state/prefill; makeConfig uses
  the default .system policy.
- MCMSConnection / APIConfiguration: update usage-sketch + doc comments.
- README / GUI-NOTES / MCMS_API.md: document system-trust-only; self-signed
  boxes need their CA installed on the device.
- Add CHANGELOG.md for this session, flagged for the Android port.

Note: configs previously persisted with the self-signed policy fail to decode
and reset to defaults (one-time re-entry of the server URL).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

README.md

@@ -33,11 +33,12 @@ Until then, this folder is the source of truth — edit here, copy into Xcode.
 - **App name / icon:** set the target's **Display Name → "PON Go"**, and drag
   `Assets.xcassets/AppIcon.appiconset` into the project's asset catalog (replacing
   the existing AppIcon).
-- **App Transport Security:** self-signed TLS is handled in code by
-  `ServerTrustEvaluator` (no Info.plist change for HTTPS cert validation). For
-  plain **HTTP** hosts, add a *scoped* `NSAppTransportSecurity` →
-  `NSExceptionDomains` entry for that host in Info.plist — never
-  `NSAllowsArbitraryLoads`.
+- **App Transport Security:** the app uses **system TLS trust only** — there is no
+  self-signed bypass (parity with the Android client). A self-signed appliance must
+  have its CA installed on the device (MDM/configuration profile); otherwise the
+  connection fails with `APIError.serverTrust`. For plain **HTTP** hosts, add a
+  *scoped* `NSAppTransportSecurity` → `NSExceptionDomains` entry for that host in
+  Info.plist — never `NSAllowsArbitraryLoads`.
 
 ## Verify off-device (no iOS SDK needed)