Docs: Add certificate-error handling docs & API notes (#389)

Document and annotate the new EnableIgnoreCertificateErrors builder behavior. Updated core docs and migration guides to describe the startup-only API, security warning, builder/native defaults (builder:true, native:false), and platform-specific implementations (Windows: --ignore-certificate-errors WebView2 flag; Linux: WEBKIT_TLS_ERRORS_POLICY_IGNORE; macOS: trust in didReceiveAuthenticationChallenge:). Added XML docs to IBrowserInfiniFrameWindowBuilderFeature and its extensions and clarified tests to note runtime assignment is unsupported.

Author: Scarlet-Bytes

docs/docs/guides/core-window.md

@@ -178,10 +178,23 @@ builder
     .SetJavascriptClipboardAccessEnabled(true)
     .SetMediaStreamEnabled(true)           // Camera/microphone access
     .SetSmoothScrollingEnabled()
-    .SetIgnoreCertificateErrorsEnabled()
+    .EnableIgnoreCertificateErrors()
     .SetUserAgent("MyApp/1.0")
 ```
 
+### Certificate Error Handling
+
+`EnableIgnoreCertificateErrors(bool)` controls whether SSL/TLS certificate errors are ignored by the browser engine.
+
+> ⚠️ **Security Warning**: Enabling this feature bypasses SSL/TLS certificate validation. Only use in controlled development/test scenarios. Never enable in production applications handling sensitive data.
+
+- This is a **startup-only** configuration and cannot be changed at runtime.
+- The builder default is `true`; the native layer default is `false`.
+- Platform-specific behavior:
+  - **Windows**: Passes `--ignore-certificate-errors` Chromium flag to WebView2
+  - **Linux**: Sets `WEBKIT_TLS_ERRORS_POLICY_IGNORE` on WebKit data manager
+  - **macOS**: Trusts all server certificates in `didReceiveAuthenticationChallenge:` delegate
+
 ## DevTools and Remote Debugging
 
 `SetDevToolsEnabled(bool)` and remote debugging are separate controls:

docs/docs/migration/photino-backlog.md

@@ -69,7 +69,7 @@ This backlog will be used to track any remaining issues or features that need to
 | ✅      | Problem with "insecure origins"                                                               | [Photino.NET#25](https://github.com/tryphotino/photino.NET/issues/25)   |                                                                                                                                                                                                                     |
 | ❓      | JS injection into WebView                                                                     | [Photino.NET#58](https://github.com/tryphotino/photino.NET/issues/58)   |                                                                                                                                                                                                                     |
 | 📝     | Creating a 2nd PhotinoWindow after closing all others fails                                   | [Photino.NET#59](https://github.com/tryphotino/photino.NET/issues/59)   | [InfiniFrame#290](https://github.com/InfiniLore/InfiniFrame/issues/290)                                                                                                                                             |
-| 📝     | Is there a way to bypass WebKits SSL check?                                                   | [Photino.NET#65](https://github.com/tryphotino/photino.NET/issues/65)   | [InfiniFrame#291](https://github.com/InfiniLore/InfiniFrame/issues/291)                                                                                                                                             |
+| ✅      | Is there a way to bypass WebKits SSL check?                                                   | [Photino.NET#65](https://github.com/tryphotino/photino.NET/issues/65)   | [InfiniFrame#291](https://github.com/InfiniLore/InfiniFrame/issues/291) - First-class `EnableIgnoreCertificateErrors(bool)` builder API with platform-specific implementations (Windows: WebView2 Chromium flag, Linux: WebKit TLS policy, macOS: certificate trust delegate) |
 | ✅      | Javascript debugging                                                                          | [Photino.NET#71](https://github.com/tryphotino/photino.NET/issues/71)   | [InfiniFrame#292](https://github.com/InfiniLore/InfiniFrame/issues/292) - explicit `SetRemoteDebuggingPort`, loopback-only endpoint on Windows/WebKitGTK Linux, deterministic lifecycle, macOS unsupported behavior, plus capability-gated diagnostics under `window.Debug` |
 | ❓      | Make window transparent                                                                       | [Photino.NET#73](https://github.com/tryphotino/photino.NET/issues/73)   |                                                                                                                                                                                                                     |
 | ❓      | Chromeless Window                                                                             | [Photino.NET#80](https://github.com/tryphotino/photino.NET/issues/80)   |                                                                                                                                                                                                                     |

docs/docs/migration/photino-breaking-changes.md

@@ -13,6 +13,7 @@ This document walks through what changed to help you migrate.
 - [Event System](#event-system)
 - [Web Messaging and Message Routing](#web-messaging-and-message-routing)
 - [Web Security, CORS, and Trusted Origins](#web-security-cors-and-trusted-origins)
+- [Certificate Error Handling](#certificate-error-handling)
 - [Logging](#logging)
 - [Native C++ Interface](#native-c-interface)
 - [Known Photino Issues Addressed](#known-photino-issues-addressed)
@@ -266,6 +267,45 @@ var app = InfiniFrameBlazorAppBuilder.CreateDefault(windowBuilder: wb => {
 | Trust all origins (explicit opt-in) | `builder.SetTrustAllOrigins(true)`                    |
 | Browser engine security toggle      | `builder.SetWebSecurityEnabled(bool)`                 |
 
+## Certificate Error Handling
+
+### Photino: no built-in API
+
+Photino had no built-in API for bypassing SSL/certificate errors. Users needed custom handling, often involving raw browser startup arguments or platform-specific workarounds.
+
+### InfiniFrame: first-class API
+
+InfiniFrame provides a first-class `EnableIgnoreCertificateErrors(bool)` API:
+
+```csharp
+var window = InfiniFrameWindowBuilder.Create()
+    .EnableIgnoreCertificateErrors(true) // Default: true in builder
+    .Build();
+```
+
+- **Builder-time configuration only** — like Photino's behavior, this is startup-only and cannot be changed at runtime.
+- **Default is `true`** in the builder, `false` in the native layer.
+- **Platform-specific behavior**:
+  - Windows: Passes `--ignore-certificate-errors` Chromium flag to WebView2
+  - Linux: Sets `WEBKIT_TLS_ERRORS_POLICY_IGNORE` on WebKit data manager
+  - macOS: Trusts all server certificates in `didReceiveAuthenticationChallenge:` delegate
+
+### Migration pattern
+
+Replace custom certificate bypass code with the builder API:
+
+```csharp
+// Before (Photino custom workaround)
+// window.SetBrowserControlInitParameters("--ignore-certificate-errors");
+
+// After (InfiniFrame)
+var window = InfiniFrameWindowBuilder.Create()
+    .EnableIgnoreCertificateErrors(true)
+    .Build();
+```
+
+> ⚠️ **Security Warning**: Enabling this feature bypasses SSL/TLS certificate validation. Only use in controlled development/test scenarios. Never enable in production applications handling sensitive data.
+
 ## Logging
 
 ### Photino: integer verbosity

src/InfiniFrame.Shared/Window/Features/Browser/IBrowserInfiniFrameWindowBuilderFeature.cs

@@ -115,6 +115,9 @@ public interface IBrowserInfiniFrameWindowBuilderFeature : IInfiniFrameWindowBui
 
     /// <summary>
     ///     Enables or disables ignoring certificate errors.
+    ///     <para>⚠️ Security Warning: Enabling this feature bypasses SSL/TLS certificate validation. Only use in controlled development/test scenarios. Never enable in production applications handling sensitive data.</para>
+    ///     <para>This is a startup-only configuration and cannot be changed at runtime.</para>
+    ///     <para>Platform-specific behavior: Windows passes --ignore-certificate-errors Chromium flag to WebView2; Linux sets WEBKIT_TLS_ERRORS_POLICY_IGNORE on WebKit data manager; macOS trusts all server certificates in didReceiveAuthenticationChallenge: delegate.</para>
     /// </summary>
     /// <param name="enabled">Whether certificate errors should be ignored.</param>
     void EnableIgnoreCertificateErrors(bool enabled);

src/InfiniFrame.Shared/Window/Features/Browser/IBrowserInfiniFrameWindowBuilderFeatureExtensions.cs

@@ -85,6 +85,9 @@ public static IInfiniFrameWindowBuilder EnableMediaStream(this IInfiniFrameWindo
 
     /// <summary>
     ///     Enables or disables ignoring certificate errors for the builder.
+    ///     <para>⚠️ Security Warning: Enabling this feature bypasses SSL/TLS certificate validation. Only use in controlled development/test scenarios. Never enable in production applications handling sensitive data.</para>
+    ///     <para>This is a startup-only configuration and cannot be changed at runtime.</para>
+    ///     <para>Platform-specific behavior: Windows passes --ignore-certificate-errors Chromium flag to WebView2; Linux sets WEBKIT_TLS_ERRORS_POLICY_IGNORE on WebKit data manager; macOS trusts all server certificates in didReceiveAuthenticationChallenge: delegate.</para>
     /// </summary>
     /// <param name="builder">The builder instance.</param>
     /// <param name="enabled">Whether certificate errors should be ignored.</param>

tests/InfiniTests.InfiniFrame/Window/Features/Browser/IgnoreCertificateErrorsTests.cs

@@ -43,6 +43,10 @@ public async Task AtBuilderStage_ExtensionAssignment(bool value, CancellationTok
         await Assert.That(initParameters.IgnoreCertificateErrorsEnabled).IsEqualTo(value);
     }
 
+    // NOTE: Direct runtime assignment of IgnoreCertificateErrors is not supported because the native layer
+    // only implements a getter (read from init params). The value is startup-only and cannot be changed
+    // after window creation. Use AtWindowStage_ThroughBuilderAssignment to test the builder-time path.
+    //
     // [Test]
     // [NotInParallelInfiniTests]
     // [Arguments(true)]