feat: project skeleton, CLI surface, generate command, secret redaction, and CI matrix

- Create Rust binary crate with clap CLI (listen, connect, generate, version)
- Implement generate command: CA/server/client certs, auth token, config.json
- Strict secret redaction: Redacted type, PEM/token/config redaction utilities
- Configurable addresses and ports with validation (fails before sockets open)
- GitHub Actions CI matrix: Windows/Linux/macOS with fmt, clippy, test, build,
  release-build, and smoke check jobs
- 39 unit tests covering CLI parsing, redaction, config, and credential generation
- Cross-platform safe paths and clean-room implementation

.github/workflows/ci.yml

@@ -0,0 +1,110 @@
+name: CI
+
+on:
+  push:
+    branches: [main, master]
+  pull_request:
+    branches: [main, master]
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  fmt:
+    name: cargo fmt
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt
+      - run: cargo fmt --check
+
+  clippy:
+    name: cargo clippy (${{ matrix.os }})
+    needs: [fmt]
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy
+      - run: cargo clippy --all-targets -- -D warnings
+
+  test:
+    name: cargo test (${{ matrix.os }})
+    needs: [fmt]
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - run: cargo test --all-targets
+
+  build:
+    name: cargo build (${{ matrix.os }})
+    needs: [fmt]
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - run: cargo build
+
+  release-build:
+    name: cargo build --release (${{ matrix.os }})
+    needs: [test]
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - run: cargo build --release
+      - name: Upload artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: rustunnel-${{ matrix.os }}
+          path: target/release/rustunnel${{ matrix.os == 'windows-latest' && '.exe' || '' }}
+          retention-days: 7
+
+  smoke:
+    name: CLI smoke (${{ matrix.os }})
+    needs: [release-build]
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - run: cargo build --release
+      - name: rustunnel --help
+        run: target/release/rustunnel --help
+      - name: rustunnel version
+        run: target/release/rustunnel version
+      - name: rustunnel listen --help
+        run: target/release/rustunnel listen --help
+      - name: rustunnel connect --help
+        run: target/release/rustunnel connect --help
+      - name: rustunnel generate --help
+        run: target/release/rustunnel generate --help
+      - name: Invalid command fails
+        run: target/release/rustunnel invalid-cmd || true
+        shell: bash
+      - name: Invalid port fails
+        run: target/release/rustunnel listen --listen localhost:bad --cert x --key x --ca-cert x --auth-token x || true
+        shell: bash