docs+plugin: HTTP-only transport cleanup, install guide, review fixes

- docs/install.md: new end-to-end guide for non-technical users
  (gateway install, app install, LAN/TLS/remote connection, push,
  options, troubleshooting); docs/setup.md now points to it
- README: new 'Install the gateway' section; pairing section updated
  for HTTP transport (8791, QR scan on Android)
- rename IRIS_WS_HOST -> IRIS_HTTP_HOST (clean rename, no compat
  fallback); drop dead DEFAULT_PORT=8790
- setup.py: advertise https:// in the printed/QR server URL when
  IRIS_HTTP_CERT is set
- ws_probe.py/e2e.py: default --url http://127.0.0.1:8791, env
  IRIS_WS_URL -> IRIS_HTTP_URL, honor explicit port + https scheme
- plugin.yaml: IRIS_HTTP_* env names, description no longer says
  'WebSocket server'
- docs 03/09/12/19: fix stale WS-era refs (ws_server.py cites,
  8790 smoke test, WSS->HTTPS, 'HTTP fallback' reframed as the
  only transport)
- AGENTS.md: symlink name android -> iris (matches actual install)
- test: adapter reads IRIS_HTTP_HOST/CERT/KEY from env; legacy
  IRIS_WS_* names are not consulted (95/95 pass)

gateway-plugin/tests/test_android.py

@@ -100,11 +100,11 @@ def adapter(plugin, monkeypatch):
     monkeypatch.setenv("IRIS_TOKEN", TOKEN)
     # Clear any IRIS transport overrides leaked into the process env by earlier
     # tests (e.g. test_interactive_setup_prints_qr runs the real
-    # interactive_setup(), which save_env_value()s IRIS_HTTP_PORT/IRIS_WS_HOST).
+    # interactive_setup(), which save_env_value()s IRIS_HTTP_PORT/IRIS_HTTP_HOST).
     # Without this, a later adapter would bind the leaked port (8791) instead of
     # the ephemeral 0 below, colliding with a live gateway on that port.
     monkeypatch.delenv("IRIS_HTTP_PORT", raising=False)
-    monkeypatch.delenv("IRIS_WS_HOST", raising=False)
+    monkeypatch.delenv("IRIS_HTTP_HOST", raising=False)
     from gateway.platform_registry import PlatformEntry, platform_registry
 
     # Platform("iris") resolves only once the platform is registered
@@ -139,6 +139,54 @@ def adapter(plugin, monkeypatch):
         pass
 
 
+def test_adapter_reads_http_env_overrides(plugin, monkeypatch, tmp_path):
+    """IRIS_HTTP_HOST / IRIS_HTTP_CERT / IRIS_HTTP_KEY are read from the env
+    (overriding config.yaml extra), and the legacy IRIS_WS_* names are NOT
+    consulted (HTTP-only transport, docs/19)."""
+    monkeypatch.setenv("IRIS_TOKEN", TOKEN)
+    monkeypatch.setenv("IRIS_HTTP_HOST", "192.168.1.50")
+    monkeypatch.setenv("IRIS_HTTP_CERT", str(tmp_path / "cert.pem"))
+    monkeypatch.setenv("IRIS_HTTP_KEY", str(tmp_path / "key.pem"))
+    # Legacy WS-era names must be ignored, even if present.
+    monkeypatch.setenv("IRIS_WS_HOST", "10.9.9.9")
+    monkeypatch.setenv("IRIS_WS_CERT", str(tmp_path / "old.pem"))
+    from gateway.platform_registry import platform_registry
+
+    if not platform_registry.is_registered("iris"):
+        from gateway.platform_registry import PlatformEntry
+
+        platform_registry.register(
+            PlatformEntry(
+                name="iris",
+                label="Android",
+                adapter_factory=lambda cfg: None,
+                check_fn=lambda: True,
+            )
+        )
+
+    config = SimpleNamespace(
+        extra={"host": "127.0.0.1", "http_port": 0},
+        home_channel=None,
+    )
+    a = plugin.adapter.IrisAdapter(config)
+    try:
+        assert a.host == "192.168.1.50"  # env wins over extra
+        assert a.http_cert == str(tmp_path / "cert.pem")
+        assert a.http_key == str(tmp_path / "key.pem")
+        # Legacy names are not read: host/cert are not the old values.
+        assert a.host != "10.9.9.9"
+        assert a.http_cert != str(tmp_path / "old.pem")
+    finally:
+        try:
+            a._devices.close()
+        except Exception:
+            pass
+        try:
+            a._outbox.close()
+        except Exception:
+            pass
+
+
 class HttpTestClient:
     """Mimics the old WS client interface over the HTTP transport (docs/19).