feat: plan-approval overlay, auth-expiry handling, cert download, login reset

- Add a dedicated plan-approval bottom sheet (interactive-prompt) driven by
  ExitPlanMode's now-4-option layout (Claude Code v2.1.177), with
  approve/YOLO/reject/feedback wired through respondPlan(requestId).
- PermissionManager: stop auto-expiring AskUserQuestion/plan prompts and stop
  releasing pending prompts on client disconnect — they reflect real CLI
  state and must survive reconnects.
- Detect server-rejected tokens (401/403 or failed WS handshake) and bounce
  back to the login screen via a new AUTH_EXPIRED_EVENT.
- Add `/cert` endpoint + Settings entry so phones can download/trust the
  self-signed HTTPS cert directly; fix cert IP detection on non-macOS hosts.
- Add `clawtap reset-login` command and `/api/auth/reset-attempts` endpoint
  to clear login rate-limit lockouts.
- Codex adapter: only forward recognized keystrokes/option indices to tmux,
  never the synthetic "deny" dismissal signal.
- PWA: actively poll for service-worker updates (iOS standalone apps don't
  reliably check on navigation).
- update-service.sh: install tmux if missing, prompt to create the env file
  instead of failing, add --skip-firewall, and improve logging.

README.md

@@ -184,6 +184,8 @@ tailscale serve --bg 3456
 clawtap cert
 ```
 
+If you're using a self-signed certificate, open `https://<your-ip>:3456/cert` on your phone to download and trust it directly (iOS: Install Profile → enable full trust in Certificate Trust Settings; Android: Settings → Security → Install certificate → CA certificate) — no need to AirDrop/email it manually.
+
 **2. Install PWA:** Open the URL in Safari → Share → **Add to Home Screen**.
 
 **3. Enable notifications:** On first login in standalone mode, ClawTap automatically prompts for notification permission. You can also toggle notifications manually in **Settings**.
@@ -266,6 +268,7 @@ SQLite with WAL mode. Stores review history, push subscriptions, rate limiting,
 | Stale sessions | `tmux kill-session -t clawtap` |
 | Port in use | `lsof -i :3456` then `kill <PID>` |
 | Hooks not cleaned after crash | `clawtap hooks uninstall` or `clawtap stop` |
+| `ERR_SSL_PROTOCOL_ERROR` | Server is on HTTP — use `http://` URL, or run `clawtap cert` to enable HTTPS |
 | Push notifications not working | Ensure HTTPS + PWA installed from home screen |
 | Adapter not showing | Check that the CLI is installed: `which claude`, `which codex`, `which gemini` |
 | Gemini hooks failing | Verify timeout is in milliseconds (5000, not 5) |