Parity with the Android client: drop the "Allow self-signed certificate"
escape hatch. The app now performs system TLS trust only — a self-signed
appliance must have its CA installed on the device (MDM/profile). A code-only
public-key pinning policy remains (no UI).
- ServerTrustEvaluator: remove ServerTrustPolicy.allowSelfSignedForHost and its
challenge handler; keep .system (default) and .pinPublicKeySHA256.
- SettingsView: remove the self-signed toggle/state/prefill; makeConfig uses
the default .system policy.
- MCMSConnection / APIConfiguration: update usage-sketch + doc comments.
- README / GUI-NOTES / MCMS_API.md: document system-trust-only; self-signed
boxes need their CA installed on the device.
- Add CHANGELOG.md for this session, flagged for the Android port.
Note: configs previously persisted with the self-signed policy fail to decode
and reset to defaults (one-time re-entry of the server URL).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
