Serve MCP over HTTPS for the Claude Desktop connector

Claude Desktop's custom connector only accepts https URLs. Added an optional TLS listener (HTTPS_ADDR + TLS_CERT_FILE/TLS_KEY_FILE) alongside HTTP; docker-compose publishes 127.0.0.1:8443 and mounts a local mkcert cert from certs/ (git-ignored). Best-effort: a missing cert logs a warning and stays HTTP-only. Verified the Windows store trusts the mkcert cert and MCP initialize succeeds over https://127.0.0.1:8443/mcp.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.env.example

@@ -7,6 +7,20 @@
 # authentication (AGENT.md §0). Only bind to a non-local interface deliberately.
 LISTEN_ADDR=127.0.0.1:8080
 
+# HTTPS (optional, but REQUIRED for the MCP connector — Claude Desktop only
+# accepts https:// URLs). When HTTPS_ADDR and both cert/key are set, an HTTPS
+# listener starts alongside HTTP. docker-compose sets these to the mounted certs.
+# Generate a locally-trusted cert on the HOST with mkcert (installs a local CA
+# your OS — and Claude Desktop — will trust), from the project root:
+#   winget install FiloSottile.mkcert
+#   mkcert -install                          # trust step (adds the local CA)
+#   mkdir certs
+#   mkcert -cert-file certs/localhost.pem -key-file certs/localhost-key.pem localhost 127.0.0.1 ::1
+# Then connect Claude Desktop to https://localhost:8443/mcp
+HTTPS_ADDR=
+TLS_CERT_FILE=
+TLS_KEY_FILE=
+
 # Roots to scan for Git repositories, comma-separated (absolute paths).
 # Inside Docker these must be the *container* paths that the host roots are
 # mounted to (see docker-compose.yml). Example: /repos,/work/other