Remove edge glow; prefill MCMS URL from env; drop self-signed-cert option

- Remove the animated neon edge-glow entirely (HTML element + CSS) — it
  couldn't be made to follow the border reliably on iOS Safari.
- Add PFW_MCMS_URL: the web server prefills the login "Host URL" field with
  it (injected as the input's value in the served index; still editable).
  Documented in env.example + web README.
- Remove the "Accept self-signed TLS certificate" option: the checkbox is
  gone and both backends now always use rejectUnauthorized:true — MCMS must
  present a valid certificate. Dropped the acceptSelfSigned plumbing from the
  renderer and both login handlers.

Docs: CLAUDE.md (drop edge-glow section, update login note) + web README.

Verified: node --check; no stale refs (in-self-signed / acceptSelfSigned /
edge-glow / beamspin); served index carries value="…" only when
PFW_MCMS_URL is set, and no self-signed checkbox.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

web/README.md

@@ -43,6 +43,7 @@ cookie jar) per session.
 |---|---|---|
 | `PORT` | `8080` | listen port |
 | `HOST` | `127.0.0.1` | bind address — `0.0.0.0` if the proxy is on another host |
+| `PFW_MCMS_URL` | — | prefill the login "Host URL" field (still editable) |
 | `PFW_CACHE_TTL_SECONDS` | `60` | shared upstream cache TTL; `0` disables (see Caching) |
 | `PFW_IDLE_MINUTES` | `30` | idle-session expiry (logs the MCMS session out) |
 | `PFW_SECURE_COOKIE` | off | force the `Secure` cookie flag (else inferred from `X-Forwarded-Proto: https`) |
@@ -142,8 +143,9 @@ LXC firewall + the NPM access list.
   memory**. Run it behind HTTPS, keep `HOST=127.0.0.1`, and rely on the
   idle timeout. The session cookie is `HttpOnly`, `SameSite=Lax`, and
   `Secure` behind TLS.
-- "Accept self-signed TLS certificate" disables verification **to MCMS**
-  for that session only (same as the desktop app).
+- TLS to MCMS is **always verified** — MCMS must present a valid certificate
+  (there is no accept-self-signed option). If your MCMS uses an internal CA,
+  install that CA on the host running the server.
 - There's no app-level user directory — anyone who can reach the page and
   has valid MCMS credentials can log in. Restrict network access at the
   proxy (mTLS / SSO / IP allow-list) if you need more than MCMS auth.

web/deploy/pon-fleet-web.env.example

@@ -2,6 +2,10 @@
 # Copy to /etc/pon-fleet-web.env and edit. All values are optional; the
 # defaults shown are what the server uses if a line is omitted.
 
+# Prefill the login "Host URL" field so operators don't type it each time.
+# (Still editable in the form.) Use the MCMS PON Manager root URL.
+#PFW_MCMS_URL=https://mcms.example.net
+
 # Listen port.
 #PORT=8080
 

web/server.js

@@ -38,6 +38,7 @@ const PORT = Number(process.env.PORT) || 8080;
 const HOST = process.env.HOST || '127.0.0.1';
 const IDLE_MS = (Number(process.env.PFW_IDLE_MINUTES) || 30) * 60 * 1000;
 const VERBOSE = process.env.PFW_VERBOSE === '1';
+const MCMS_URL = process.env.PFW_MCMS_URL || ''; // prefilled into the login host field
 const CACHE_TTL_MS = (process.env.PFW_CACHE_TTL_SECONDS !== undefined
   ? Number(process.env.PFW_CACHE_TTL_SECONDS) : 60) * 1000;
 const ROOT = __dirname;
@@ -208,6 +209,12 @@ function serveIndex(res) {
   html = html.replace(/<script src="app\.js"><\/script>/i,
     '<script src="/api-web.js"></script>\n  <script src="/shared/app.js"></script>');
 
+  // Prefill the login host field from PFW_MCMS_URL (server-side default).
+  if (MCMS_URL) {
+    const v = MCMS_URL.replace(/&/g, '&amp;').replace(/"/g, '&quot;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
+    html = html.replace(/(<input id="in-host"[^>]*?)\s*\/?>/i, `$1 value="${v}" />`);
+  }
+
   res.writeHead(200, { 'Content-Type': MIME['.html'] });
   res.end(html);
 }
@@ -527,8 +534,9 @@ const server = http.createServer(async (req, res) => {
     // Login establishes a session + its own McmsClient.
     if (name === 'login') {
       const body = await readBody(req, SMALL_BODY);
-      const { baseUrl, username, password, acceptSelfSigned } = body || {};
-      const client = new McmsClient({ baseUrl, rejectUnauthorized: !acceptSelfSigned, verbose: VERBOSE });
+      const { baseUrl, username, password } = body || {};
+      // TLS is always verified — MCMS must present a valid certificate.
+      const client = new McmsClient({ baseUrl, rejectUnauthorized: true, verbose: VERBOSE });
       try {
         const result = await client.login(username, password);
         const sid = crypto.randomUUID();
@@ -590,5 +598,6 @@ server.listen(PORT, HOST, () => {
   console.log(`[pon-fleet-web] listening on http://${HOST}:${PORT}`);
   console.log(`[pon-fleet-web] idle session timeout: ${IDLE_MS / 60000} min · verbose MCMS: ${VERBOSE}`);
   console.log(`[pon-fleet-web] upstream cache: ${cache.enabled() ? (CACHE_TTL_MS / 1000) + 's TTL (shared per MCMS host)' : 'disabled'}`);
+  if (MCMS_URL) console.log(`[pon-fleet-web] login host prefilled with: ${MCMS_URL}`);
   console.log('[pon-fleet-web] put a TLS-terminating reverse proxy (Caddy/nginx/NPM) in front for remote use.');
 });