Remove self-signed TLS option (system trust only); add session changelog

Parity with the Android client: drop the "Allow self-signed certificate"
escape hatch. The app now performs system TLS trust only — a self-signed
appliance must have its CA installed on the device (MDM/profile). A code-only
public-key pinning policy remains (no UI).

- ServerTrustEvaluator: remove ServerTrustPolicy.allowSelfSignedForHost and its
  challenge handler; keep .system (default) and .pinPublicKeySHA256.
- SettingsView: remove the self-signed toggle/state/prefill; makeConfig uses
  the default .system policy.
- MCMSConnection / APIConfiguration: update usage-sketch + doc comments.
- README / GUI-NOTES / MCMS_API.md: document system-trust-only; self-signed
  boxes need their CA installed on the device.
- Add CHANGELOG.md for this session, flagged for the Android port.

Note: configs previously persisted with the self-signed policy fail to decode
and reset to defaults (one-time re-entry of the server URL).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

SettingsView.swift

@@ -10,7 +10,6 @@ struct SettingsView: View {
     @State private var urlString = "https://"
     @State private var apiVersion = "v1"
     @State private var databaseId = ""
-    @State private var allowSelfSigned = false
 
     @State private var testPhase: LoadPhase = .idle
     @State private var testResult: String?
@@ -38,16 +37,6 @@ struct SettingsView: View {
                     .autocorrectionDisabled()
             }
 
-            Section {
-                Toggle("Allow self-signed certificate", isOn: $allowSelfSigned)
-            } header: {
-                Text("Security")
-            } footer: {
-                Text(allowSelfSigned
-                     ? "Trusts the certificate for this host only. Use only on a controlled management network/VPN. For production, install the CA via MDM and leave this off, or add public-key pinning in code."
-                     : "Uses standard system trust evaluation (recommended).")
-            }
-
             Section {
                 Button {
                     Task { await runTest() }
@@ -104,17 +93,15 @@ struct SettingsView: View {
         urlString = config.baseURL.absoluteString
         apiVersion = config.apiVersion
         databaseId = config.databaseId ?? ""
-        if case .allowSelfSignedForHost = config.trustPolicy { allowSelfSigned = true }
     }
 
     private func makeConfig() -> APIConfiguration? {
-        guard let url = Self.normalizedBaseURL(urlString), let host = url.host else { return nil }
-        let policy: ServerTrustPolicy = allowSelfSigned ? .allowSelfSignedForHost(host) : .system
+        // TLS uses system trust only (no self-signed bypass); trustPolicy defaults to .system.
+        guard let url = Self.normalizedBaseURL(urlString), url.host != nil else { return nil }
         return APIConfiguration(
             baseURL: url,
             apiVersion: apiVersion.trimmingCharacters(in: .whitespaces),
-            databaseId: databaseId.isEmpty ? nil : databaseId,
-            trustPolicy: policy
+            databaseId: databaseId.isEmpty ? nil : databaseId
         )
     }