Proposal: trust the CA on a phone by scanning a QR code (`portless trust --device`)

LAN mode points at ~/.portless/ca.pem for devices, but getting it trusted on a phone is the slow part: iOS needs a configuration profile and then a separate full-trust toggle, and Android only installs a CA from Settings, never from a download. Neither screen can be deep-linked from a page.

Proposal

portless trust --device prints a QR code and the CA's SHA-256 fingerprint. The page it opens:

• offers a .mobileconfig on iOS, a DER .crt on Android and PEM elsewhere, with the profile's UUIDs derived from the fingerprint so reinstalling replaces it;
• lists the remaining taps for that platform (Android: search Settings for "CA certificate"; restart Chrome if it kept a "Proceed" exception);
• shows the fingerprint to compare.

It's served over plain HTTP on the LAN address, either by the port-80 redirect listener on one well-known path, or by a short-lived server while the command runs. proxy start --lan could mention it in place of the bare path. #211's dashboard could host the same page.

Draft

#572 does this with a short-lived server at a one-time path for ten minutes, and has screenshots of the terminal and the page. On Android, Chrome went from the QR code to a trusted .local app; the iOS profile passes plutil -lint but hasn't been tried on a device.

Open question

Should a CA meant for phones carry name constraints for portless's TLDs? It would cap what a leaked key could sign, at the cost of re-trusting devices whenever the TLDs change.