Add HTTPS management console and response planning

docs/OPERATIONS.md

@@ -38,6 +38,10 @@ deliberately practical: what to run, what to expect, and what to check next.
    sudo systemctl enable --now enodia-sentinel-web
    ```
 
+   Open the `https://...` URL from the service log. The default certificate is
+   self-signed, so add a browser exception or configure `web_tls_cert` and
+   `web_tls_key` with your own local/private CA certificate.
+
 6. Configure one off-box notification or watchdog path. A local-only alerting
    path is not enough if the whole host goes silent.
 
@@ -76,29 +80,38 @@ When Sentinel fires:
    and parent process.
 3. Run `enodia-sentinel triage` to separate known benign listener noise from
    findings that need review.
-4. If the alert involves a binary, run:
+4. Build a read-only response plan from the grouped incident:
+
+   ```bash
+   enodia-sentinel incident list
+   enodia-sentinel respond plan <incident-id>
+   ```
+
+   Review the plan before acting; Sentinel does not execute containment
+   commands.
+5. If the alert involves a binary, run:
 
    ```bash
    enodia-sentinel fim-check --packages
    enodia-sentinel pkgdb-verify --sample 200
    ```
 
-5. If the alert involves hiding or tampering, run:
+6. If the alert involves hiding or tampering, run:
 
    ```bash
    enodia-sentinel rootcheck
    enodia-sentinel pkgdb-check
    ```
 
-6. Preserve evidence before changing state:
+7. Preserve evidence before changing state:
 
    ```bash
    cp -a /var/log/enodia-sentinel /tmp/enodia-sentinel-evidence
    ```
 
-7. Contain manually for now, following the matching playbook in
-   [RUNBOOKS.md](RUNBOOKS.md). Future response commands should produce a dry-run
-   plan first.
+8. Contain manually for now, following the matching playbook in
+   [RUNBOOKS.md](RUNBOOKS.md). The response plan gives reviewed commands, but
+   applying them remains an explicit operator action.
 
 ## Common Findings
 
@@ -129,6 +142,9 @@ Baselines are useful only if they represent a known-good state.
 
 - Keep the dashboard bound to Tailscale or loopback, not a public interface.
 - Set `web_token` explicitly for fully read-only service operation.
+- Keep HTTPS enabled. The built-in self-signed certificate is acceptable for a
+  single host after you add an exception; use a private/local CA for cleaner
+  browser trust.
 - Enable at least one push backend.
 - Run `watchdog` from another machine.
 - Consider `chattr +i` for Sentinel binaries, systemd units, config, baselines,