feat: secure remote connections with tls

[Enn3Developer]

No description provided.

[claude]

Claude finished @Enn3Developer's task in 35s —— View job

---

Summary

Adds TLS to client/server networking so account credentials and game traffic aren't sent in plaintext, with certificate loading/validation split into a dedicated ServerTls helper.

Changes

• Common/Network: ClientConnection wraps outbound sockets in SslStream (TLS 1.2/1.3) unless the target is loopback, validating against the OS trust store with no plaintext fallback; ClientConnection.Dispose is now idempotent via an Interlocked guard.
• Common/Network: ServerConnection accepts an optional X509Certificate2 and, when set, performs the TLS handshake per-client in the background (with a 10s timeout) before registering the client, so one slow/hostile client can't stall the accept loop.
• Common/Network: NetworkConnection accepts an injectable Stream (plaintext or TLS) and disposes it on close to unblock pending reads / send TLS close-notify.
• Server: new ServerTls loads a PKCS#12 certificate from OPENPOLYTOPIA_TLS_CERTIFICATE/OPENPOLYTOPIA_TLS_PASSWORD env vars and refuses to start a non-loopback listener without one.
• Server: GameServer loads/validates the certificate at construction and constructs ServerConnection lazily in RunAsync.
• Tests: TransportSecurityTest.cs covers cert loading/validation and loopback vs. remote behavior.

Worth a look

• Binding to null (all interfaces) is treated as non-loopback and now hard-requires a certificate — a behavior change for anyone running the server without bindAddress set to 127.0.0.1 and no cert configured.
• No client certificate / mutual TLS — only server identity is authenticated.