On-demand Model Context Protocol (MCP) server for Android — FCM push-woken, end-to-end encrypted via SNI-passthrough TLS, per-device ACME certs