Add HTTPS management console and response planning

README.md

@@ -234,8 +234,8 @@ enodia-sentinel.service`. Every key is optional. Highlights:
 
 ## Web dashboard
 
-A read-only console, served by the stdlib `http.server` (no Flask, no JS
-framework, no CDN — one self-contained page):
+A read-only HTTPS management console, served by the stdlib `http.server` (no
+Flask, no JS framework, no CDN — one self-contained page):
 
 ```bash
 enodia-sentinel web                      # serves on the Tailscale IP by default
@@ -245,13 +245,16 @@ sudo systemctl enable --now enodia-sentinel-web
 
 - **Bound to your Tailscale interface** by default (auto-detected), so it's
   reachable from your phone/laptop on the tailnet but not the LAN or internet.
+- **TLS is mandatory.** If `web_tls_cert` / `web_tls_key` are unset, Sentinel
+  auto-generates a self-signed certificate under `log_dir`. Add a browser
+  exception for now, or point config at a local/private CA certificate.
 - **Bearer-token auth** (constant-time check); the token is auto-generated and
   saved on first run and printed in the startup line. Open
-  `http://<tailscale-ip>:8787/?token=…`.
-- **Read-only**: severity cards, a live alert list, and the full forensic
-  snapshot per alert. No actions, no writes — minimal attack surface for
-  sensitive data. JSON API at `/api/status`, `/api/alerts`, `/api/alerts/<id>`,
-  `/api/events`.
+  `https://<tailscale-ip>:8787/?token=…`.
+- **Read-only management**: incidents, timelines, alert inventory, event tail,
+  and dry-run response plans. No commands are executed from the browser. JSON
+  API at `/api/status`, `/api/incidents`, `/api/respond/plan/<id>`,
+  `/api/alerts`, `/api/alerts/<id>`, `/api/events`.
 
 ## Phone push notifications
 
@@ -301,7 +304,7 @@ exposes its age. Run an external watcher on another host (over Tailscale) and
 
 ```bash
 # on a SEPARATE machine — alerts you if the sensor or the whole box goes dark
-enodia-sentinel watchdog --url http://100.x.x.x:8787 --token <T> --max-age 120
+enodia-sentinel watchdog --url https://100.x.x.x:8787 --token <T> --max-age 120 --insecure-tls
 ```
 
 **Hardening (the layers beyond on-box detection):**
@@ -497,7 +500,8 @@ verification, auto-refreshed by a pacman hook) and **false-positive triage**
 via package-ownership provenance.
 
 v0.4 — adds a read-only **web dashboard** (stdlib server, Tailscale-bound,
-token-auth) and **phone push** (ntfy / Pushover / webhook), both zero-dependency.
+token-auth; now HTTPS-only) and **phone push** (ntfy / Pushover / webhook),
+both zero-dependency.
 
 v0.3 — adds the event-driven **eBPF layer**: a real `bcc` execve probe feeding a
 Snort-style declarative rule engine (4 default rules), stable signature IDs +