Control Philips Hue lights using the CLIP API v2 over the local bridge HTTPS interface

Steps

1. Discover the Hue Bridge IP on the local network via https://discovery.meethue.com or mDNS; accept the self-signed bridge TLS certificate (or pin its public key) since the bridge uses a Philips-issued certificate not in the standard trust store
2. Create an application key by pressing the physical link button on the bridge within 30 seconds, then POST to https://<bridge-ip>/api with body {"devicetype":"my_app#my_device","generateclientkey":true}; save the returned username (hue-application-key) and clientkey
3. Set the hue-application-key header on all subsequent API v2 requests; list all light resources with GET https://<bridge-ip>/clip/v2/resource/light to get their UUIDs
4. Control a light by PUT to https://<bridge-ip>/clip/v2/resource/light/<uuid> with a JSON body; for example {"on":{"on":true},"dimming":{"brightness":80}} to turn on at 80% brightness
5. Subscribe to real-time events via the Server-Sent Events (SSE) endpoint: GET https://<bridge-ip>/eventstream/clip/v2 with the hue-application-key header; events arrive as JSON arrays describing state changes across all resources
6. For color control, use the color.xy object (CIE 1931 xy color space) or the color_temperature.mirek field for whites; check each light's color.gamut_type to know which xy values are valid for that bulb model