docs+plugin: HTTP-only transport cleanup, install guide, review fixes

- docs/install.md: new end-to-end guide for non-technical users
  (gateway install, app install, LAN/TLS/remote connection, push,
  options, troubleshooting); docs/setup.md now points to it
- README: new 'Install the gateway' section; pairing section updated
  for HTTP transport (8791, QR scan on Android)
- rename IRIS_WS_HOST -> IRIS_HTTP_HOST (clean rename, no compat
  fallback); drop dead DEFAULT_PORT=8790
- setup.py: advertise https:// in the printed/QR server URL when
  IRIS_HTTP_CERT is set
- ws_probe.py/e2e.py: default --url http://127.0.0.1:8791, env
  IRIS_WS_URL -> IRIS_HTTP_URL, honor explicit port + https scheme
- plugin.yaml: IRIS_HTTP_* env names, description no longer says
  'WebSocket server'
- docs 03/09/12/19: fix stale WS-era refs (ws_server.py cites,
  8790 smoke test, WSS->HTTPS, 'HTTP fallback' reframed as the
  only transport)
- AGENTS.md: symlink name android -> iris (matches actual install)
- test: adapter reads IRIS_HTTP_HOST/CERT/KEY from env; legacy
  IRIS_WS_* names are not consulted (95/95 pass)

gateway-plugin/setup.py

@@ -21,7 +21,6 @@ from .defaults import (
     DEFAULT_HOME_CHANNEL_NAME,
     DEFAULT_HOST,
     DEFAULT_HTTP_PORT,
-    DEFAULT_PORT,
     DEFAULT_PUSH_BACKEND,
 )
 from .pairing import (
@@ -89,7 +88,7 @@ def _env_enablement() -> dict | None:
     # clobber user YAML. Unset keys fall through to config.yaml / adapter
     # defaults.
     seed: dict[str, Any] = {}
-    host = os.getenv("IRIS_WS_HOST", "").strip()
+    host = os.getenv("IRIS_HTTP_HOST", "").strip()
     if host:
         seed["host"] = host
     http_port_raw = os.getenv("IRIS_HTTP_PORT", "").strip()
@@ -111,7 +110,7 @@ def _parse_port(raw: str) -> int:
     try:
         return int((raw or "").strip())
     except (ValueError, TypeError):
-        return DEFAULT_PORT
+        return DEFAULT_HTTP_PORT
 
 
 # ---------------------------------------------------------------------------
@@ -342,10 +341,8 @@ def interactive_setup() -> None:
     # off a lost/compromised device before continuing with the config.
     _offer_device_removal()
 
-    host = prompt("Bind host", default=get_env_value("IRIS_WS_HOST") or DEFAULT_HOST)
-    save_env_value("IRIS_WS_HOST", host or DEFAULT_HOST)
-    # _parse_port falls back to DEFAULT_PORT (8790) for empty input, so the
-    # HTTP default must be applied explicitly (docs/19: 8791).
+    host = prompt("Bind host", default=get_env_value("IRIS_HTTP_HOST") or DEFAULT_HOST)
+    save_env_value("IRIS_HTTP_HOST", host or DEFAULT_HOST)
     http_port_raw = (get_env_value("IRIS_HTTP_PORT") or "").strip()
     port = prompt(
         "HTTP port",
@@ -370,8 +367,11 @@ def interactive_setup() -> None:
     # replaced by the default-route LAN IP so the QR points somewhere a phone
     # can actually reach (the user can still override the Server URL in-app).
     advertised = advertise_host(host or DEFAULT_HOST)
-    url = pairing_url(advertised, _parse_port(port))
-    pairing = qr_payload(advertised, _parse_port(port), token)
+    # Advertise https when TLS is configured, so the printed/QR Server URL
+    # matches the scheme the gateway actually serves.
+    secure = bool((get_env_value("IRIS_HTTP_CERT") or "").strip())
+    url = pairing_url(advertised, _parse_port(port), secure=secure)
+    pairing = qr_payload(advertised, _parse_port(port), token, secure=secure)
     print_info("Pair your device (enter this on the app's Connect screen):")
     print_info(f"Pairing URL: {pairing}")
     print_info(f"Server URL: {url}")