docs: add comprehensive project wiki for v1.0

Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>

droid-wiki/how-to-contribute/testing.md

@@ -0,0 +1,75 @@
+# Testing
+
+## Test organization
+
+All tests are inline `#[cfg(test)]` modules at the bottom of each source file. There are no standalone test files or integration test directories.
+
+## Running tests
+
+```sh
+cargo test --all-targets
+```
+
+This runs unit tests and doc tests across all modules.
+
+## Test patterns
+
+### Credential generation tests
+
+Tests in `src/generate.rs` verify that `generate()` creates all expected files, that certificates contain valid PEM blocks, that private keys are detected as sensitive by the redaction module, and that config JSON is valid.
+
+### Framing tests
+
+Tests in `src/framing.rs` cover:
+
+- Frame roundtrips for all frame types (CONNECT, CONNECT_REPLY, DATA, CLOSE, ERROR)
+- Partial read handling — buffers must not be consumed until a complete frame is available
+- Multiple frames in one buffer
+- Target address encoding/decoding for IPv4 and domain names
+
+### SOCKS5 tests
+
+Tests in `src/socks5.rs` cover:
+
+- Greeting parsing (no-auth, username/password, invalid versions)
+- Auth request parsing (valid and empty credentials)
+- CONNECT request parsing (IPv4, domain, unsupported commands)
+- Reply building
+- Target resolution (IPv4 direct, domain DNS lookup)
+- Malformed input handling
+
+### TLS tests
+
+Tests in `src/tls.rs` cover:
+
+- Loading certificates and keys from files and PEM strings
+- Building valid server and client configs
+- Identity validation against SANs and CN
+- Certificate fingerprinting
+- Expiration checking
+- Insecure config variants
+
+### Tunnel tests
+
+Tests in `src/tunnel.rs` are the most extensive. They include:
+
+- **Auth tests:** valid mTLS + auth, invalid token, missing client cert
+- **E2E tests:** basic forwarding, server-side SOCKS5 reaching connector-side targets, concurrent stream isolation, target failure handling, listener-side target origin verification
+- **Operational tests:** reconnect restoring traffic after tunnel drop, graceful shutdown of listener and connector, shutdown during active streams
+- **Log tests:** verify effective config is logged with redacted tokens, verify auth failures don't leak token values in error messages
+
+## E2E test structure
+
+Typical E2E tests follow this pattern:
+
+1. Generate test credentials with `generate_test_creds()`.
+2. Pick a free port with `get_free_port()`.
+3. Spawn the listener as a tokio task.
+4. Spawn the connector (and optionally a target server) as tokio tasks.
+5. Sleep briefly to let services start.
+6. Connect via SOCKS5, send data, verify response.
+7. Abort all tasks in cleanup.
+
+## CI test matrix
+
+Tests run on `ubuntu-latest`, `windows-latest`, and `macos-latest`.