feat: secure remote connections with tls

[Enn3Developer]

No description provided.

[claude]

Claude finished @Enn3Developer's task in 37s —— View job

---

Summary

Adds TLS transport to client/server networking so credentials and game data aren't sent in plaintext once traffic leaves the local machine, while keeping loopback connections unencrypted for local dev and tests.

Changes

• Client (ClientConnection.cs): wraps the socket in SslStream unless the target is loopback (or useTls overrides), validating against the OS trust store with no plaintext fallback; handshake has a 10s timeout, and Dispose() is now idempotent.
• Server (ServerConnection.cs): accepts an optional X509Certificate2; when set, each accepted socket is TLS-authenticated in a background task (SetupClientAsync) so a slow/hostile handshake can't stall the accept loop, and failed/plaintext handshakes are dropped silently.
• Shared (NetworkConnection.cs): now takes an arbitrary Stream (plaintext or TLS) instead of always using the raw NetworkStream, and disposes that stream on close to unblock reads / send TLS close-notify.
• Server startup (GameServer.cs, new ServerTls.cs): loads a PKCS#12 certificate from OPENPOLYTOPIA_TLS_CERTIFICATE/OPENPOLYTOPIA_TLS_PASSWORD env vars and refuses to start bound to a non-loopback address without one.
• Tests (TransportSecurityTest.cs): new coverage for TLS on/off defaults, handshake timeout/failure, untrusted-certificate rejection, plaintext-vs-TLS mismatch handling, and certificate loading/validation.

Worth a look

• ServerConnection.SetupClientAsync swallows handshake failures with only a Console.Error.WriteLine — worth confirming this is sufficient observability for production.
• Server startup now refuses non-loopback binds without a certificate (ServerTls.Validate), a behavior change for any existing deployment that ran plaintext on a public interface.
• No client certificate / mutual TLS support — server trusts any client that completes the handshake.