Add HTTPS management console and response planning

docs/COMMAND_REFERENCE.md

@@ -210,6 +210,28 @@ Exit code:
 
 ## Evidence and Operator Commands
 
+### `respond`
+
+```bash
+enodia-sentinel respond plan <incident-id>
+enodia-sentinel respond plan <incident-id> --json
+```
+
+Builds a dry-run response plan from an incident's retained JSON snapshots. The
+plan may include evidence preservation, process freeze/terminate candidates,
+outbound IP blocks, systemd unit disablement, suspicious-file quarantine,
+package-restore lookup, and follow-up verification checks.
+
+This command is intentionally read-only: it prints commands for operator review
+and never executes them. The JSON schema is `enodia.response.plan.v1` and marks
+`apply_supported: false` until an audited apply workflow exists.
+
+Exit code:
+
+- `0`: plan generated.
+- `1`: unknown incident id.
+- `2`: missing incident id.
+
 ### `status`
 
 ```bash
@@ -235,6 +257,9 @@ enodia-sentinel web
 
 Starts the read-only dashboard. By default it binds to the Tailscale interface
 when available and uses bearer-token authentication for non-loopback binds.
+HTTPS is mandatory. If `web_tls_cert` / `web_tls_key` are not configured,
+Sentinel creates a self-signed pair under `log_dir`; add a browser exception for
+that certificate or replace it with a private/local CA certificate.
 
 Expected use: `enodia-sentinel-web.service`.
 
@@ -251,12 +276,14 @@ noise but never edits config automatically.
 ### `watchdog`
 
 ```bash
-enodia-sentinel watchdog --url http://100.x.y.z:8787 --token <token> --max-age 120
+enodia-sentinel watchdog --url https://100.x.y.z:8787 --token <token> --max-age 120
+enodia-sentinel watchdog --url https://100.x.y.z:8787 --token <token> --insecure-tls
 ```
 
 Polls a remote dashboard and alerts if the sensor is down, unreachable, or has a
-stale heartbeat. Run this from a separate host. A watchdog on the same machine
-does not prove the protected host is alive.
+stale heartbeat. Run this from a separate host. Use `--insecure-tls` only for
+the built-in self-signed certificate while you have no local/private CA trust
+path. A watchdog on the same machine does not prove the protected host is alive.
 
 Exit code:
 
@@ -283,9 +310,8 @@ does not require pip or a virtualenv.
 The roadmap reserves these command shapes:
 
 ```bash
-enodia-sentinel respond plan <incident-id>
 enodia-sentinel respond apply <plan-id>
 ```
 
-These should be introduced with stable JSON schemas and tests before they are
-documented as supported.
+State-changing response commands should be introduced with stable JSON schemas,
+audit logs, and tests before they are documented as supported.