Serve MCP over HTTPS for the Claude Desktop connector

Claude Desktop's custom connector only accepts https URLs. Added an optional TLS listener (HTTPS_ADDR + TLS_CERT_FILE/TLS_KEY_FILE) alongside HTTP; docker-compose publishes 127.0.0.1:8443 and mounts a local mkcert cert from certs/ (git-ignored). Best-effort: a missing cert logs a warning and stays HTTP-only. Verified the Windows store trusts the mkcert cert and MCP initialize succeeds over https://127.0.0.1:8443/mcp.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

CHANGELOG.md

@@ -69,3 +69,18 @@ Append-only running history of all changes (AGENT.md §9.1). Newest last.
 - **Gotcha:** Docker-on-Windows bind mounts do NOT deliver filesystem events, so
   air's watch-based reload silently never fired. Fixed by enabling air polling
   (`poll = true`, `poll_interval = 500` in `.air.toml`).
+
+## 2026-09-20 — HTTPS for the MCP connector (local TLS via mkcert)
+- **What:** Added an optional HTTPS listener alongside HTTP. New config
+  `HTTPS_ADDR`, `TLS_CERT_FILE`, `TLS_KEY_FILE`; when set, `cmd/server` starts
+  `e.StartTLS` on the same Echo app (best-effort — a missing cert logs a warning
+  and stays HTTP-only). docker-compose publishes `127.0.0.1:8443` and points the
+  TLS vars at `certs/localhost.pem` (mounted via the existing source mount).
+  `.gitignore` ignores `/certs/`; `.env.example` documents the mkcert steps.
+- **Why:** Claude Desktop's custom MCP connector only accepts `https://` URLs.
+  Local TLS with an mkcert-trusted cert lets `https://localhost:8443/mcp` work
+  without exposing the unauthenticated app via a public tunnel (AGENT.md §8.1).
+- **Affects:** `internal/config`, `cmd/server/main.go`, `docker-compose.yml`,
+  `.gitignore`, `.env.example`, `AGENT.md` (§8.1, §11).
+- **Host setup (user-run):** the local CA install (`mkcert -install`) is a
+  security-settings change performed by the user, not the app.