Feat: One-way TLS transport for the device port

Add optional one-way TLS on the device port (6543), enabled per client via a
pinned trust anchor, so new clients encrypt their transport while legacy
plaintext clients keep working unchanged.

Server (server/go): sniff each accepted connection and wrap TLS peers
(ClientHello 0x16 0x03 + handshake type 0x01) in crypto/tls with MinVersion
TLS 1.2; everything else stays on the plaintext path. TLS is enabled only when
both YAMA_TLS_CERT and YAMA_TLS_KEY are set, and a cert/key load failure fails
startup loudly rather than silently serving plaintext.

Client (client/, Windows): Schannel one-way TLS. When the trust anchor is
present — registry value Software\<exehash>\settings\tls_cert (REG_SZ holding
the PEM), with fallback to settings.ini [settings] tls_cert or yama-ca.pem
beside the exe — every outbound connection (main + sub-connections) completes
a TLS 1.2 handshake before the app protocol and is strictly pinned to that
anchor via a chain engine with hExclusiveRoot; any handshake/cert failure is
fail-closed (no plaintext downgrade). Send uses EncryptMessage; Recv uses
DecryptMessage and reads plaintext from the stream-mode DATA segment (bufs[1])
rather than the record header.

Co-Authored-By: deepseek-v4-pro

server/go/cmd/main.go

@@ -920,6 +920,19 @@ func main() {
 		}
 	}()
 
+	// Optional one-way TLS on the device port. Both vars must be set to enable;
+	// a cert without its key (or vice versa) is treated as disabled with a
+	// warning. The cert is loaded (and errors surfaced) inside Server.Start().
+	tlsCert := os.Getenv("YAMA_TLS_CERT")
+	tlsKey := os.Getenv("YAMA_TLS_KEY")
+	if tlsCert != "" && tlsKey != "" {
+		log.Info("TLS enabled for device port (one-way): cert=%s", tlsCert)
+	} else if tlsCert != "" || tlsKey != "" {
+		log.Warn("TLS disabled: both YAMA_TLS_CERT and YAMA_TLS_KEY must be set")
+	} else {
+		log.Info("TLS disabled (YAMA_TLS_CERT/YAMA_TLS_KEY not set) — device port is plaintext")
+	}
+
 	// Create servers for each port
 	var servers []*server.Server
 	for _, port := range ports {
@@ -928,6 +941,8 @@ func main() {
 		config.MaxConnections = 9999
 		config.PerIPMaxConnections = envInt("YAMA_PERIP_MAX_CONNS", config.PerIPMaxConnections)
 		config.PerIPConnRateLimit = envInt("YAMA_PERIP_CONN_RATE", config.PerIPConnRateLimit)
+		config.TLSCertFile = tlsCert
+		config.TLSKeyFile = tlsKey
 
 		srv := server.New(config)
 		srv.SetLogger(log.WithPrefix(fmt.Sprintf("Server:%d", port)))