feat: center square Hope presence and guide secure certificate setup

docs/PROJECT_STATUS.md

@@ -70,6 +70,43 @@ it, `devicectl device process launch` succeeded and launched `dev.shane.voice`.
 No credentials/preferences were reset, no backend changes, and no physical speech
 or authenticated WSS qualification is implied by successful installation.
 
+## Square presence and certificate onboarding — 2026-10-01
+
+User reported invalid server certificate at sign-in and requested the webapp square
+presence as the primary native avatar. Replaced Lightwell rendering with an efficient
+21×21 Canvas LED matrix, centered 220pt on welcome and 136pt above active transcript;
+smaller accessibility sizes preserve controls/readability. Mic/listening and agent
+speech levels drive separate patterns; Reduce Motion freezes motion/audio geometry.
+Existing semantic theme and single accessible status are preserved.
+
+Actual deployed leaf and SPKI pins match the app. Explicit live native HTTPS probe
+passed on both simulator and physical iPhone against `/api/auth/me` (expected401,
+no credentials). Physical native password POST reached server and returned401 for
+John Doe; user confirmed deleting this test account, so no account was recreated.
+No TLS bypass, plaintext fallback, or pin change was made. The reported original
+login failure was not reproduced by this test; installed-version or transient cause
+is not conclusively established. Admin full-auth test was interrupted by lock/lost
+testmanager connection, not claimed successful.
+
+LiveKit's SDK uses an independent system-trust WebSocket session. User approved a
+public certificate-only installation profile, exact leaf SHA256
+`07907abde3bb9c685265909927627d9ea4705d7e7b27056eefe06e10b192af46`.
+Profile is served at `https://192.168.86.2:9178/hope-server.mobileconfig`, requires
+manual installation and full trust in iPhone Settings. App login links it only
+for the exact configured LAN host/port, and certificate errors include safe recovery.
+An initial container-copy download disappeared after another backend deployment;
+fixed by persistent cert mount and exact nginx alias; verified200/apple profile MIME,
+private-key path404. Nothing installs trust automatically or weakens TLS checks.
+
+Validation: 19 conversation tests passed (3 new LED tests), simulator screenshots
+`/tmp/hope-led-welcome-ready.png` and `/tmp/hope-led-history-dark.png`. Complete
+unit suite:58 passed, including two explicit-opt-in live TLS cases skipped in offline
+run. Actual opted-in physical HTTPS test passed separately. New live tests use
+environment-only credentials, never fixtures/source/argv. Updated signed phone
+build passed (`/tmp/hope-square-phone-build.log`) and app installed/launch succeeded
+on the iPhone14ProMax (`dev.shane.voice`, 18:00 local). Real WSS/login after profile trust and
+physical speech remain user qualification.
+
 ## Current direction
 
 Keep **Qwen 2.5**. The user explicitly canceled the earlier request to switch to