[SandObserver]

Summary

• Decide TLS verification skipping in one place (resolveSkipTls), applying the existing internal-host restriction to the per-item skipTlsVerify flag and the per-request skipTls field, not just the server-wide setting.
• Return a vouched message on a certificate failure where the skip was requested but not applicable, on both the fetch and ping paths.
• Default the session idle window to 12 hours, and reissue a token past the halfway mark from the router so an active session is extended; add readToken and refreshSession.
• Reject a state-changing request that carries no Origin header, rather than allowing it through.
• Bind the API to 127.0.0.1, which is the only address nginx proxies to.
• Withhold passwordSet and setupPrompted from /api/auth/check unless the caller is authenticated.
• Ask before carrying skipTlsVerify across a foreign-config import, via insecureApps and clearSkipTls and a checkbox in the import preview; reuse the existing app.allowSelfSigned and app.selfSignedTip strings so no catalog gains a key.

Testing
All green, plus a live check against a public host with a self-signed certificate. Added 22 tests: certificate-skip scoping across both outbound paths, session renewal and expiry, the origin requirement, the pre-auth reply, and the import decision.

Checklist

• Stays within the project constraints: one container, no runtime dependencies, no build step (see CONTRIBUTING.md).
• Tests added or updated for new logic, and the full suite, lint, and typechecks pass.
• Docs updated if behavior or configuration changed.
• CHANGELOG.md updated under Unreleased if the change is user-visible.