Prepare unified native remote establishment and trusted stream admission

[Tryanks]

What changes

Prepares the existing unified remote entry for a later transport adapter; this does not implement iroh. Relates to #376.

Existing native HTTP/HTTPS pairing, the main WebSocket and paired Preview now share origin validation, DNS, staggered address attempts and TCP/TLS establishment. WebSocket address attempts still race through the full upgrade and hello, preserving terminal authentication failures and the existing handshake deadline. NativeClientHost pairing uses cancellable async I/O while synchronous CLI callers keep their existing interface. HTTPS /pair already used the same code-to-token flow; this adds no certificate-based pairing or new authentication mechanism.

RemoteServer admits generic duplex streams into the existing HTTP, WebSocket, NDJSON and CONNECT dispatch. Imported streams always have remote provenance and cannot gain local administration from loopback forwarding or X-Forwarded-For. Actual direct peers retain existing authorization and first-time password/pairing behavior. Both entries share connection limits and shutdown. Async split I/O preserves read/write concurrency and write-half close; native accept uses async-net's TCP close contract.

macOS keeps its existing Preview URL mapping and slot lifetime, now including HTTPS paired origins. Windows/Android use an attachment-owned raw loopback bridge to the same host entry, retaining native proxy authentication and bypass behavior. Windows' callback and Android's proxy configuration receive the bridge origin and existing token. Remote WebView2 environments use temporary directories owned with the environment because attachment proxy arguments differ; local Preview retains its existing directory.

Why these seams

TCP versus TLS and direct versus imported streams are current variability. Establishment policy disappears from individual callers; protocol, auth, replay/recovery, URL mapping and host dispatch remain at their existing owners. The native bridge does not parse or recreate HTTP and adds no business protocol, global route table, persisted identity format, account, registry or iroh dependency.

Regression evidence

Targeted production-entry tests passed during implementation, including existing HTTPS pairing compatibility, WS/Preview CONNECT over verified TLS, imported local-admin denial with a spoofed header, existing direct-local admin, token rejection, HTTP timeout/cancellation, native bridge authentication and reverse half-close, admission cancellation/shutdown, existing Preview mapping/lifetime, reconnect and replay tests.

All required local checks passed (exit 0) on 6b33382054f3629a7ad004ce6ef8c95549c27f87:

• cargo fmt --all --check
• cargo clippy --workspace --all-targets --locked -- -D warnings
• cargo build --workspace --locked
• cargo test --workspace --locked, including existing runtime remote_liveness stalled-address, rejected-token and stopped-host tests; existing ignored environment-dependent fixtures remain ignored.
• RUSTFLAGS='-D warnings' IPHONEOS_DEPLOYMENT_TARGET=26.0 cargo check -p tcode-ios --target aarch64-apple-ios-sim --locked
• RUSTFLAGS='-D warnings' ANDROID_HOME=/opt/homebrew/share/android-commandlinetools ANDROID_NDK_HOME=/opt/homebrew/share/android-commandlinetools/ndk/27.1.12297006 cargo ndk -t arm64-v8a check -p tcode-android --locked
• RUSTFLAGS='-D warnings' cargo check -p tcode-web --target wasm32-unknown-unknown --locked
• cargo-machete . using direct binary version 0.9.2 (avoids the known wrapper invocation bug).

Local Cargo checks used CARGO_TARGET_DIR=/Users/tryanks/RustroverProjects/tcode/target and CARGO_PROFILE_DEV_DEBUG=line-tables-only. Build emitted the macOS linker large-unwind-table warning; Cargo also reports the existing block 0.1.6 future-compatibility notice. Neither is a Clippy/source warning failure.

Hosted CI run 34258034479 passed on that same head: plan, dependency hygiene (8s), mobile/Web (2m32s), Linux (7m55s), macOS (10m2s), and Windows (10m33s). The existing-run watcher exited 0. All required checks passed. The lead inspected the final source and head-bound local evidence before merging.

Remaining integration and validation scope

No iroh endpoint ownership, dialing/admission adapter, route/identity/discovery integration, relay deployment or browser transport integration is included. WebHost still uses browser fetch and WebSocket at the page origin. Iroh WASM support does not automatically adapt those interfaces or arbitrary Preview page networking. iOS still lacks embedded Preview.

Native Windows/Android UI acceptance was not run; local platform compilation passed as listed above. No provider prompt, user profile or original checkout was used for acceptance. Merged after lead source/evidence review and all required checks passed.