feat: implement HTTPS mTLS tunnel with auth handshake

Add HTTPS default tunnel endpoint and outbound connector using Rustls
with mTLS and an additional auth/session token.

- Add rustls, tokio-rustls, hyper, and related dependencies
- Implement TLS config builders (server/client) with cert validation
- Implement HTTPS tunnel listener with mTLS accept and auth handshake
- Implement HTTPS tunnel connector with server cert validation
- Add auth token loading from CLI value or file
- Add security gate state machine for tracking auth progression
- Fail closed for missing/invalid TLS config, cert mismatch, auth failures
- Port conflicts fail without fallback
- Reconnect revalidates all security gates
- 67 tests covering all validation assertions

src/cli.rs

@@ -33,8 +33,12 @@ pub enum Commands {
         ca_cert: String,
 
         /// Auth/session token required from connecting clients
-        #[arg(long, value_name = "TOKEN")]
+        #[arg(long, default_value = "", value_name = "TOKEN")]
         auth_token: String,
+
+        /// Path to a file containing the auth/session token (alternative to --auth-token)
+        #[arg(long, value_name = "PATH")]
+        auth_token_file: Option<String>,
     },
 
     /// Connect to the HTTPS tunnel listener and expose a local SOCKS5 proxy
@@ -64,8 +68,12 @@ pub enum Commands {
         ca_cert: String,
 
         /// Auth/session token to authenticate with the listener
-        #[arg(long, value_name = "TOKEN")]
+        #[arg(long, default_value = "", value_name = "TOKEN")]
         auth_token: String,
+
+        /// Path to a file containing the auth/session token (alternative to --auth-token)
+        #[arg(long, value_name = "PATH")]
+        auth_token_file: Option<String>,
     },
 
     /// Generate local certificate and auth material