fix: persist verified iPhone certificate onboarding download

QUALIFICATION.md

@@ -1,5 +1,20 @@
 # Multi-user Hermes migration — qualification and operations
 
+## iPhone certificate onboarding follow-up — 2026-10-01
+
+User reported certificate error at iOS sign-in. Current pinned native HTTPS probe
+passed on the physical phone, while deleted John Doe account correctly returned401.
+User confirmed deleting the disposable account; do not recreate it. Prior receipts
+below describe historical qualification, not current John account existence.
+
+User approved public certificate trust onboarding. Exact nginx route
+`/hope-server.mobileconfig` serves only `/etc/voice/certs/hope-server.mobileconfig`
+from persistent certificate mount with `application/x-apple-aspen-config` and
+`Cache-Control: no-store`. It is a verified public certificate profile, no keys or
+credentials; requires manual iOS profile installation + full trust for WSS. Private
+key URL remains404. Do not expose the entire cert directory. Initial container-copy
+profile disappeared during intervening deployment; persistent alias fixed it.
+
 ## Deployment
 
 Target: Unraid `192.168.86.2`, public UI `https://192.168.86.2:9178`.