Remove edge glow; prefill MCMS URL from env; drop self-signed-cert option

- Remove the animated neon edge-glow entirely (HTML element + CSS) — it
  couldn't be made to follow the border reliably on iOS Safari.
- Add PFW_MCMS_URL: the web server prefills the login "Host URL" field with
  it (injected as the input's value in the served index; still editable).
  Documented in env.example + web README.
- Remove the "Accept self-signed TLS certificate" option: the checkbox is
  gone and both backends now always use rejectUnauthorized:true — MCMS must
  present a valid certificate. Dropped the acceptSelfSigned plumbing from the
  renderer and both login handlers.

Docs: CLAUDE.md (drop edge-glow section, update login note) + web README.

Verified: node --check; no stale refs (in-self-signed / acceptSelfSigned /
edge-glow / beamspin); served index carries value="…" only when
PFW_MCMS_URL is set, and no self-signed checkbox.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

main.js

@@ -63,11 +63,12 @@ function toWireError(err) {
   return { message: err?.message || String(err) };
 }
 
-ipcMain.handle('api:login', async (_ev, { baseUrl, username, password, acceptSelfSigned }) => {
+ipcMain.handle('api:login', async (_ev, { baseUrl, username, password }) => {
   try {
     client = new McmsClient({
       baseUrl,
-      rejectUnauthorized: !acceptSelfSigned,
+      // TLS is always verified — MCMS must present a valid certificate.
+      rejectUnauthorized: true,
       // Verbose logging goes to the Electron terminal (npm start output).
       // Turn off by setting PON_FLEET_VERBOSE=0 in the env.
       verbose: process.env.PON_FLEET_VERBOSE !== '0',