docs+plugin: HTTP-only transport cleanup, install guide, review fixes

- docs/install.md: new end-to-end guide for non-technical users
  (gateway install, app install, LAN/TLS/remote connection, push,
  options, troubleshooting); docs/setup.md now points to it
- README: new 'Install the gateway' section; pairing section updated
  for HTTP transport (8791, QR scan on Android)
- rename IRIS_WS_HOST -> IRIS_HTTP_HOST (clean rename, no compat
  fallback); drop dead DEFAULT_PORT=8790
- setup.py: advertise https:// in the printed/QR server URL when
  IRIS_HTTP_CERT is set
- ws_probe.py/e2e.py: default --url http://127.0.0.1:8791, env
  IRIS_WS_URL -> IRIS_HTTP_URL, honor explicit port + https scheme
- plugin.yaml: IRIS_HTTP_* env names, description no longer says
  'WebSocket server'
- docs 03/09/12/19: fix stale WS-era refs (ws_server.py cites,
  8790 smoke test, WSS->HTTPS, 'HTTP fallback' reframed as the
  only transport)
- AGENTS.md: symlink name android -> iris (matches actual install)
- test: adapter reads IRIS_HTTP_HOST/CERT/KEY from env; legacy
  IRIS_WS_* names are not consulted (95/95 pass)

app/shared/src/commonMain/kotlin/iris/net/TlsPinning.kt

@@ -14,7 +14,7 @@ import javax.net.ssl.X509TrustManager
 /**
  * TLS certificate pinning for self-signed gateways (docs/09 §9.4).
  *
- * A gateway behind `IRIS_HTTP_CERT`/`IRIS_WS_CERT` may present a
+ * A gateway behind `IRIS_HTTP_CERT` may present a
  * self-signed certificate the platform doesn't trust. Instead of forcing the
  * user to install it into the system trust store, the app shows the
  * certificate's SHA-256 fingerprint on first pair (SSH host-key style); once