# Ticket 2.6 — Onboarding HTTP Redirect Server

**Phase**: 2 — Server & WebSocket Layer
**Priority**: Medium
**Depends on**: 2.1

## Description

Run a secondary HTTP server (on the HTTPS port + 1) that redirects to HTTPS. This helps users who type the URL without `https://` — instead of a connection error, they get seamlessly redirected. Also serves an onboarding page that guides users through certificate trust on mobile.

## Acceptance Criteria

### AC1: HTTP server redirects to HTTPS

```gherkin
Given the HTTPS server is running on port 2633
When a browser makes an HTTP request to port 2634
Then it receives a 301 redirect to https://same-host:2633/
```

### AC2: Mobile certificate trust page

```gherkin
Given a mobile device connects for the first time
When the HTTPS certificate is self-signed
Then the onboarding page explains how to trust the certificate
And it provides device-specific instructions (iOS / Android)
```

### AC3: HTTP server only runs alongside HTTPS

```gherkin
Given the main server is running in HTTP mode (no mkcert)
Then the redirect server does NOT start
And no onboarding page is needed
```

## Testable Components

| Component | Test Type | What to Assert |
|-----------|-----------|----------------|
| HTTP redirect | Fixture | Request to HTTP port returns 301 to HTTPS |
| Redirect URL | Unit | Preserves path and query params in redirect |
| Conditional start | Unit | Only starts when HTTPS is active |

## Reference

- Claude-relay onboarding: `../claude-relay/lib/server.js` (lines 346-394)
