feat: add connection key encoding and full tunnel implementation

Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>

src/redact.rs

@@ -118,6 +118,11 @@ pub fn is_auth_token(content: &str) -> bool {
             .all(|c| c.is_alphanumeric() || c == '-' || c == '_')
 }
 
+#[allow(dead_code)]
+pub fn is_connection_key(content: &str) -> bool {
+    content.trim_start().starts_with("rtun1.")
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -206,6 +211,12 @@ mod tests {
         assert!(!is_auth_token("short"));
     }
 
+    #[test]
+    fn is_connection_key_detects_rtun_prefix() {
+        assert!(is_connection_key("rtun1.abc"));
+        assert!(!is_connection_key("abc"));
+    }
+
     #[test]
     fn tracing_logs_redact_secrets() {
         // Verify that tracing with a Redacted value doesn't leak secrets