update install script

.gitignore

@@ -12,6 +12,7 @@
 !/dark-mechanicus/
 !/llama.cpp/
 !/scripts/
+!/session-handoff/
 !/shared/
 !/tests/
 !/themes/

scripts/install-client.sh

@@ -266,10 +266,12 @@ fi
 
 if [[ $SKIP_VERIFY -eq 0 ]] && want certs; then
 	echo; echo "==> Verifying mTLS reachability"
+	# Server cert is LE-issued (publicly trusted) — rely on the system CA
+	# bundle, matching ai-server/{stream,admin}.ts which omit `ca:`. The local
+	# root-ca.pem is kept around only to satisfy loadCerts() in config.ts.
 	if curl -sS --max-time 5 \
 			--cert "$PI_DIR/certs/client.pem" \
 			--key "$PI_DIR/certs/client-key.pem" \
-			--cacert "$PI_DIR/certs/root-ca.pem" \
 			"$AI_SERVER_URL/health" | grep -q '"ok"'; then
 		echo "    ✓ mTLS handshake + /health OK"
 	else