Serve MCP over HTTPS for the Claude Desktop connector

Claude Desktop's custom connector only accepts https URLs. Added an optional TLS listener (HTTPS_ADDR + TLS_CERT_FILE/TLS_KEY_FILE) alongside HTTP; docker-compose publishes 127.0.0.1:8443 and mounts a local mkcert cert from certs/ (git-ignored). Best-effort: a missing cert logs a warning and stays HTTP-only. Verified the Windows store trusts the mkcert cert and MCP initialize succeeds over https://127.0.0.1:8443/mcp.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

AGENT.md

@@ -345,6 +345,13 @@ obeys the safety rules (§1.4).
   `github.com/modelcontextprotocol/go-sdk`. Claude Desktop connects to it as a
   **custom connector**. Like the rest of the app it is **localhost‑bound and
   unauthenticated** (Section 0) — do not expose it off‑host without asking.
+- **The connector requires `https://`** (Claude Desktop rejects plain `http`).
+  So `/mcp` is also served over **TLS on localhost** with a **locally‑trusted
+  cert** (mkcert‑generated; the app just reads the cert/key files). Installing the
+  local CA into the OS trust store is a **host setup step the user performs**, not
+  something the app or Claude does (it is a security‑settings change). Do **not**
+  reach for a public tunnel to get HTTPS — that would expose an unauthenticated
+  repo‑management app to the internet.
 - MCP **tools are thin adapters** over the service layer — no Git/forge logic in
   the tool handlers (§1.7). Expected tools (grow as features land):
   - Read: `list_repos`, `get_repo`, `get_active_project`, `get_activity`,
@@ -507,9 +514,11 @@ silently guess.)*
 - ✅ **RESOLVED 2026-09-19:** **Project handoff is cooperative** — user requests a
   switch, Claude finishes to a safe checkpoint, switches, and the user is notified;
   pull‑first, not autonomous (Section 8.3).
-- **MCP connector setup:** confirm this Claude Desktop build supports adding a
-  local Streamable‑HTTP custom connector (`http://127.0.0.1:8080/mcp`); if not,
-  fall back to a stdio shim.
+- ✅ **RESOLVED 2026-09-20:** Claude Desktop's custom connector **requires
+  `https://`**. Resolved with **local TLS via mkcert** — connect to
+  `https://localhost:8443/mcp` (HTTP dashboard stays on `:8080`). The user runs
+  `mkcert -install` + cert generation on the host (§8.1); the stdio‑shim fallback
+  is no longer needed.
 - **Idle‑trigger for handoff:** the pull model syncs at Claude's turn boundaries.
   If Claude is idle when the user switches, decide the nudge (user's next message,
   a heartbeat/poll, or a host push if available) — do not assume instant wake.