chore: record pre-existing uncommitted repository state

Snapshot of the in-flight state that already existed, identically, in both
this worktree and the main checkout before this session began: the initial
HTTP Client platform implementation (previously untracked), the redis-lab
removal, and the JPA / object-storage / notification integration work.

Kept separate from this session's HTTP Client review response, which lands
in the following commit, so the two bodies of work stay reviewable apart.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

infra/httpclient/tls/README.md

@@ -0,0 +1,16 @@
+# TLS fixtures
+
+Certificates are generated **in process** by `TlsFixture`, not checked in. A committed private key
+is a private key that leaks, and design §21.2 forbids key material in the repository.
+
+`TlsFixture` produces, from a throwaway CA created per test run:
+
+| Fixture | Purpose |
+|---|---|
+| `TlsFixture.trusted()` | a server certificate valid for the loopback host |
+| `TlsFixture.hostnameMismatch()` | a certificate whose SAN does not match the connection host |
+| `TlsFixture.expired()` | an already-expired certificate |
+| `clientHandshake(true)` | client key material for the mTLS lane |
+
+All three failure cases must classify as permanent (design §21.3) — never retried, never downgraded
+to plaintext.