feat: center square Hope presence and guide secure certificate setup

docs/ENGINEERING_LEARNINGS.md

@@ -29,6 +29,23 @@ Read [PROJECT_STATUS.md](PROJECT_STATUS.md) for the current product scope.
   logging at error. Offline auth fixtures use memory tokens, isolated preferences
   and deterministic no-network bootstrap errors.
 
+## Native certificate diagnosis and square presence — 2026-10-01
+
+- Match actual leaf and SPKI before changing a pin. Matching source pins do not
+  prove every SDK session uses the delegate; LiveKit owns a private system-trust
+  URLSession for WSS. App HTTPS probe passed physically; do not conflate a401 from
+  a deleted account with TLS failure or recreate unwanted test accounts.
+- Gate live TLS tests with explicit opt-in and print started/skipped scope; a test
+  returning early is not runtime proof. Regenerate XcodeGen for added test membership.
+  Physical test bundles require a development team override, not just app signing.
+- Certificate profiles require public-only verified data, user installation/full
+  trust, and persistent hosting. Copying a file into an active container is erased
+  at redeploy. Exact nginx alias may expose a public profile from cert mount; never
+  expose the directory containing the private key. Use apple profile MIME/no-store.
+- Canvas dot matrix is one accessible avatar, not441 focusable LEDs. Pause animation
+  when inactive and freeze audio geometry with Reduce Motion. Primary square remains
+  centered while active size/dynamic type leave space for transcript and controls.
+
 ## Preserve behavior across UI changes
 
 - Observe nested observable objects directly where their data is rendered. Watching

docs/PROJECT_STATUS.md

@@ -70,6 +70,43 @@ it, `devicectl device process launch` succeeded and launched `dev.shane.voice`.
 No credentials/preferences were reset, no backend changes, and no physical speech
 or authenticated WSS qualification is implied by successful installation.
 
+## Square presence and certificate onboarding — 2026-10-01
+
+User reported invalid server certificate at sign-in and requested the webapp square
+presence as the primary native avatar. Replaced Lightwell rendering with an efficient
+21×21 Canvas LED matrix, centered 220pt on welcome and 136pt above active transcript;
+smaller accessibility sizes preserve controls/readability. Mic/listening and agent
+speech levels drive separate patterns; Reduce Motion freezes motion/audio geometry.
+Existing semantic theme and single accessible status are preserved.
+
+Actual deployed leaf and SPKI pins match the app. Explicit live native HTTPS probe
+passed on both simulator and physical iPhone against `/api/auth/me` (expected401,
+no credentials). Physical native password POST reached server and returned401 for
+John Doe; user confirmed deleting this test account, so no account was recreated.
+No TLS bypass, plaintext fallback, or pin change was made. The reported original
+login failure was not reproduced by this test; installed-version or transient cause
+is not conclusively established. Admin full-auth test was interrupted by lock/lost
+testmanager connection, not claimed successful.
+
+LiveKit's SDK uses an independent system-trust WebSocket session. User approved a
+public certificate-only installation profile, exact leaf SHA256
+`07907abde3bb9c685265909927627d9ea4705d7e7b27056eefe06e10b192af46`.
+Profile is served at `https://192.168.86.2:9178/hope-server.mobileconfig`, requires
+manual installation and full trust in iPhone Settings. App login links it only
+for the exact configured LAN host/port, and certificate errors include safe recovery.
+An initial container-copy download disappeared after another backend deployment;
+fixed by persistent cert mount and exact nginx alias; verified200/apple profile MIME,
+private-key path404. Nothing installs trust automatically or weakens TLS checks.
+
+Validation: 19 conversation tests passed (3 new LED tests), simulator screenshots
+`/tmp/hope-led-welcome-ready.png` and `/tmp/hope-led-history-dark.png`. Complete
+unit suite:58 passed, including two explicit-opt-in live TLS cases skipped in offline
+run. Actual opted-in physical HTTPS test passed separately. New live tests use
+environment-only credentials, never fixtures/source/argv. Updated signed phone
+build passed (`/tmp/hope-square-phone-build.log`) and app installed/launch succeeded
+on the iPhone14ProMax (`dev.shane.voice`, 18:00 local). Real WSS/login after profile trust and
+physical speech remain user qualification.
+
 ## Current direction
 
 Keep **Qwen 2.5**. The user explicitly canceled the earlier request to switch to