[BUG] preview_start embedded browser rejects locally-trusted mkcert certificates

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

preview_start cannot load HTTPS dev servers that use locally-trusted certificates (e.g. from mkcert). Both the health check and the embedded Chromium browser reject the certificates, even though they are trusted by the host system's certificate store.

This forces workarounds like making the dev server serve HTTP instead, which breaks the ability to use the same server from a regular browser for OAuth flows that require HTTPS.

Steps to Reproduce

1. Generate localhost certs with mkcert localhost and install the CA with mkcert -install
2. Configure a dev server (e.g. Vite) to use these certs for HTTPS
3. Set up .claude/launch.json with "url": "https://localhost:5100"
4. Run preview_start

Expected Behavior

Preview browser trusts locally-installed CAs, page loads normally.

Actual Behavior

Two issues:

1. Health check rejects the cert — "Awaiting server..." forever (likely Node.js-based, doesn't use system trust store)
2. Embedded Chromium rejects the cert — navigating via preview_eval with window.location.replace('https://...') lands on chrome-error://chromewebdata/

Suggested Fix

• Health check: respect NODE_EXTRA_CA_CERTS or read system trust store
• Embedded Chromium: launch with --ignore-certificate-errors for localhost, or import system CA roots

Workaround

Configure the dev server to serve HTTP when launched from preview_start, but this means HTTPS-dependent flows (like OAuth) can't be tested in a regular browser on the same server.

Environment

• OS: macOS 15.4
• Claude Code: latest (Claude Desktop)
• Cert tool: mkcert v1.4.4