[KOB-53650] Honor KOBITON_TRUST_ALL_CERTS across proxy and REST clients in all languages

[chuong777]

Problem

Test projects produced by the generator fail to run against a Kobiton Standalone server using a self-signed SSL certificate — specifically on the direct Kobiton REST calls (device lookup GET /v1/devices, app download URL GET /v1/app/versions/{id}/downloadUrl, OTP /v1/otp/*), not the Appium/WebDriver traffic.

A generated project makes HTTPS calls in two places:

1. The local proxy that forwards Appium/WebDriver commands.
2. Direct REST calls that bypass the proxy.

Before this change, TLS handling was inconsistent — only some proxies disabled verification, and the direct REST clients always validated certs:

Language	Proxy (Appium)	Direct REST (devices / app / OTP)
Python	verify=False → OK	requests, no verify= → rejects
Node	secure:false → OK	axios, no httpsAgent → rejects
Java	default OkHttpClient → rejects	new OkHttpClient() → rejects
C#	default HttpClient → rejects	new HttpClient() → rejects

Fix

Introduce one opt-in env flag, KOBITON_TRUST_ALL_CERTS=true, read consistently in every language and wired into both the proxy and all REST clients. Default keeps TLS validation on (secure by default); set the flag only for standalone self-signed servers.

• Python — centralize the flag in config.py; proxy_server.py, test_base.py, and otp_service.py all pass verify=not Config.TRUST_ALL_CERTS; warning suppression centralized.
• Node — Config.TRUST_ALL_CERTS from env; base.js sets a permissive axios.defaults.httpsAgent; proxy.js gates secure on the flag.
• Java — Config.TRUST_ALL_CERTS + Config.createHttpClientBuilder() trust-all OkHttpClient.Builder; used by ProxyServer, TestBase (2 sites), OtpService.
• C# — Config.TrustAllCerts + Config.CreateHttpClient() with a permissive HttpClientHandler; used by ProxyServer, TestBase (3 sites), OtpService.
• Replaced the old per-language workarounds in the READMEs (-Djavax.net.ssl.trustStoreType=KeychainStore, NODE_TLS_REJECT_UNAUTHORIZED=0) with the unified flag, documented for macOS/Linux and Windows (PowerShell).

The env-var read is cross-platform; only the shell syntax to set it differs (documented per OS).

Testing notes

• Default (flag unset): TLS validation unchanged — no behavior change for cloud users.
• With KOBITON_TRUST_ALL_CERTS=true against a self-signed Standalone: device lookup, app download, OTP, and the Appium proxy all connect.
• Only affects https:// server URLs; http:// standalone URLs are unaffected.

Jira: https://kobiton.atlassian.net/browse/KOB-53650

🤖 Generated with Claude Code

[d4rkwinz]

Reviewed as a TLS-bypass change (risk: trusting too much, or an insecure default). Read all four clients + the untouched call sites.

• Coverage is complete — verified, not assumed: C# 5/5 and Java 4/4 client constructions converted; Node's single axios.defaults.httpsAgent covers all 5 call sites (none override the agent) + proxy.js separately. This is the thing most likely to be wrong in a "wire it everywhere" PR; it's right.
• Default got more secure, not just "unchanged": Python proxy_server.py (TRUST_ALL_CERTS=True) and Node proxy.js (secure:false) were insecure-by-default before; both now validate unless the flag is set. Worth stating in the description as hardening.
• One scope note: the flag disables hostname + chain validation, i.e. trusts any cert — broader than "accept this self-signed one." Fine for generated test code (runs in CI against a server you control), but keep README framing scoped to standalone — which it does.

🟢 Merge.