Feat: One-way TLS transport for the device port

Add optional one-way TLS on the device port (6543), enabled per client via a
pinned trust anchor, so new clients encrypt their transport while legacy
plaintext clients keep working unchanged.

Server (server/go): sniff each accepted connection and wrap TLS peers
(ClientHello 0x16 0x03 + handshake type 0x01) in crypto/tls with MinVersion
TLS 1.2; everything else stays on the plaintext path. TLS is enabled only when
both YAMA_TLS_CERT and YAMA_TLS_KEY are set, and a cert/key load failure fails
startup loudly rather than silently serving plaintext.

Client (client/, Windows): Schannel one-way TLS. When the trust anchor is
present — registry value Software\<exehash>\settings\tls_cert (REG_SZ holding
the PEM), with fallback to settings.ini [settings] tls_cert or yama-ca.pem
beside the exe — every outbound connection (main + sub-connections) completes
a TLS 1.2 handshake before the app protocol and is strictly pinned to that
anchor via a chain engine with hExclusiveRoot; any handshake/cert failure is
fail-closed (no plaintext downgrade). Send uses EncryptMessage; Recv uses
DecryptMessage and reads plaintext from the stream-mode DATA segment (bufs[1])
rather than the record header.

Co-Authored-By: deepseek-v4-pro

server/go/.vscode/launch.json

@@ -13,7 +13,9 @@
                 "--http-port=8080"
             ],
             "env": {
-                "YAMA_WEB_ADMIN_PASS": "3.14159"
+                "YAMA_WEB_ADMIN_PASS": "3.14159",
+                "YAMA_TLS_CERT": "${workspaceFolder}/certs/server.crt",
+                "YAMA_TLS_KEY": "${workspaceFolder}/certs/server.key"
             },
             "console": "integratedTerminal",
             "preLaunchTask": "sync-web-assets"
@@ -30,7 +32,9 @@
                 "--http-port=8080"
             ],
             "env": {
-                "YAMA_WEB_ADMIN_PASS": "3.14159"
+                "YAMA_WEB_ADMIN_PASS": "3.14159",
+                "YAMA_TLS_CERT": "${workspaceFolder}/certs/server.crt",
+                "YAMA_TLS_KEY": "${workspaceFolder}/certs/server.key"
             },
             "console": "integratedTerminal",
             "buildFlags": "-gcflags='all=-N -l'",