fix: remove conflicting ATS CA pin and verify physical LiveKit trust

docs/ENGINEERING_LEARNINGS.md

@@ -38,6 +38,10 @@ Read [PROJECT_STATUS.md](PROJECT_STATUS.md) for the current product scope.
 - Gate live TLS tests with explicit opt-in and print started/skipped scope; a test
   returning early is not runtime proof. Regenerate XcodeGen for added test membership.
   Physical test bundles require a development team override, not just app signing.
+- Proven device ATS trap: `NSPinnedCAIdentities` can still reject a manually
+  full-trusted self-signed server with -1202/-9807. Same-phone A/B removal of this
+  redundant rule made system HTTPS and actual LiveKit WSS pass. Retain exact app
+  HTTP pin + normal SDK system trust; do not infer validity-length cause from dates.
 - Certificate profiles require public-only verified data, user installation/full
   trust, and persistent hosting. Copying a file into an active container is erased
   at redeploy. Exact nginx alias may expose a public profile from cert mount; never