Bolt TLS handled directly on port 7687 — see Fase 2.1 in migracion-ai.md