TLS guardrails (insecure http refusal, custom CAs) and deployment guide

tests/cli.rs

@@ -324,6 +324,40 @@ fn cli_key_rotation() {
     assert!(data.join("key.hex.bak").exists());
 }
 
+#[test]
+fn cli_relay_refuses_plain_http_off_loopback() {
+    let output = frxd()
+        .args([
+            "relay",
+            "--listen",
+            "127.0.0.1:0",
+            "--url",
+            "http://10.0.0.1:1",
+            "--peer",
+            "http://10.0.0.1:2",
+        ])
+        .output()
+        .unwrap();
+    assert!(!output.status.success());
+    let stderr = String::from_utf8_lossy(&output.stderr);
+    assert!(stderr.contains("allow-insecure"), "{stderr}");
+
+    let port = common::free_port();
+    let _service = spawn_service(
+        &[
+            "relay".to_string(),
+            "--listen".to_string(),
+            format!("127.0.0.1:{port}"),
+            "--url".to_string(),
+            "http://10.0.0.1:1".to_string(),
+            "--peer".to_string(),
+            "http://10.0.0.1:2".to_string(),
+            "--allow-insecure".to_string(),
+        ],
+        "relay listening",
+    );
+}
+
 #[test]
 fn cli_full_network_pipeline() {
     let root = tempfile::tempdir().unwrap();