docs(13): record the app-port TLS work and its two remaining gaps

Includes the rustls finding (it does not verify key/certificate pairing) so
the explicit check is not later mistaken for redundant, and the archi-dev-box
caveat: it has no HTTPS dashboard, so it cannot reproduce the iframe failure.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.planning/todos/pending/2026-08-06-open-operational-tasks.md

@@ -44,6 +44,29 @@ request (protocol unverified, zero allowance), E-09 naive-user comprehension stu
   `ssl_verify_result=0`; rejected without it). **STILL OPEN:** app ports serve plain HTTP —
   putting the CA-signed leaf on them is what actually closes the bug. UX polish deferred by
   the operator ("we'll decide on the actual UX later").
+- **HTTPS on app ports — BUILT, NOT DEPLOYED.** `7515166a`: the gate serves TLS and plain
+  HTTP on the same port, chosen per connection by peeking the first byte (`0x16` = TLS
+  ClientHello; `peek` does not consume, so the acceptor sees it whole). Cert/key mtimes
+  stamped as a pair; 15s first-byte timeout; PKCS#8 + PKCS#1 both accepted. **Existing nodes
+  unaffected by construction** — non-TLS bytes take the identical old path, and a node with
+  no certificate serves plain HTTP exactly as today. 38/38 appgate tests.
+  **FINDING: rustls does NOT check that a key matches its certificate** — `with_single_cert`
+  accepted a mismatched pair and would only have failed mid-handshake in a browser. Proven by
+  test, then fixed with an explicit sign/verify pairing check. Do not remove it.
+  **STILL OPEN, both needed for "works first time":**
+  (a) nothing provisions the CA automatically — `setup-node-ca.sh` must be run by hand, and
+      existing nodes carry a bare self-signed leaf that is NOT CA-signed, so installing the CA
+      does nothing until the leaf is reissued. Needs a boot-time ensure, shaped like
+      `bootstrap::ensure_restart_policy()`.
+  (b) no "Refresh certificate" button in Settings → System → Node certificate, for when a
+      node gains an address.
+  Test target: archi-dev-box can prove the HTTP path is unbroken and that TLS answers on an
+  app port, but it has NO HTTPS dashboard (nginx has no 443 block; the 443 listener is
+  Tailscale serve → `127.0.0.1:8787`), so it cannot reproduce the original iframe failure.
+  Also: this box answers to BOTH `archi-dev-box` and `archi-thinkpad` — two memory notes
+  treat them as separate machines.
+- **App frames follow the dashboard scheme — FIXED `f09ff102`** (http→http, https→https;
+  `pageScheme()` defaults to http so plain-HTTP nodes are untouched).
 - **App health UX — FIXED `c65ee03a`** (needs deploy to be real). A container that is up but
   not answering its probe now reads "<App> is starting…" with its own pulsing icon while the
   6×10s auto-retries are in flight; the hard failure copy returns once they are exhausted.