feat: direct TCP URI with SSL toggle and optional password auth (#635)

* feat: direct TCP URI with SSL toggle and optional password auth

Replaces the heuristic-driven direct-connection model with a user-controlled
one. The Add Host dialog now exposes structured Host, Port, "Use SSL", and
masked Password fields that compose the canonical
`tcp://host:port?ssl=true&password=xxx` URI used as the storage form.

The daemon gains optional shared-secret auth: `Authorization: Bearer <pw>` on
HTTP and `Sec-WebSocket-Protocol: paseo.bearer.<pw>` on the WS upgrade
(browser WebSocket can't set custom headers). Configured via config.json
`auth.password` or `PASEO_PASSWORD` env. Off by default — old clients keep
working unchanged.

The `port === 443` heuristic for ws/wss is gone; the explicit `useTls` flag
drives scheme selection at every call site.

* fix: stabilize direct tcp auth ci checks

* fix: restore fetch stub in bootstrap smoke test

* fix(app): collapse Advanced section in add-host modal

* feat(server): hash daemon password in config

* fix: update lockfile signatures and Nix hash

* Improve direct TCP auth failures

* Fix workspace cwd updates after rebase

---------

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

packages/app/src/utils/test-daemon-connection.test.ts

@@ -1,10 +1,12 @@
 import { describe, expect, it, vi, beforeEach } from "vitest";
 
 const daemonClientMock = vi.hoisted(() => {
-  const createdConfigs: Array<{ clientId?: string; url?: string }> = [];
+  const createdConfigs: Array<{ clientId?: string; url?: string; password?: string }> = [];
+  let nextConnectError: Error | null = null;
+  let nextLastError: string | null = null;
 
   class MockDaemonClient {
-    public lastError: string | null = null;
+    public lastError: string | null = nextLastError;
     private lastServerInfo = {
       status: "server_info" as const,
       serverId: "srv_probe_test",
@@ -12,7 +14,7 @@ const daemonClientMock = vi.hoisted(() => {
       version: "0.0.0",
     };
 
-    constructor(config: { clientId?: string; url?: string }) {
+    constructor(config: { clientId?: string; url?: string; password?: string }) {
       createdConfigs.push(config);
     }
 
@@ -25,6 +27,9 @@ const daemonClientMock = vi.hoisted(() => {
     }
 
     async connect(): Promise<void> {
+      if (nextConnectError) {
+        throw nextConnectError;
+      }
       return;
     }
 
@@ -44,6 +49,15 @@ const daemonClientMock = vi.hoisted(() => {
   return {
     MockDaemonClient,
     createdConfigs,
+    setNextConnectFailure: (error: Error, lastError: string | null) => {
+      nextConnectError = error;
+      nextLastError = lastError;
+    },
+    reset: () => {
+      createdConfigs.length = 0;
+      nextConnectError = null;
+      nextLastError = null;
+    },
   };
 });
 
@@ -74,8 +88,9 @@ vi.mock("@/desktop/daemon/desktop-daemon-transport", () => ({
 
 describe("test-daemon-connection connectToDaemon", () => {
   beforeEach(() => {
-    daemonClientMock.createdConfigs.length = 0;
+    daemonClientMock.reset();
     clientIdMock.getOrCreateClientId.mockClear();
+    vi.stubGlobal("__DEV__", false);
   });
 
   it("reuses the app clientId for direct connections", async () => {
@@ -115,4 +130,53 @@ describe("test-daemon-connection connectToDaemon", () => {
       "paseo+local://socket?path=%2Ftmp%2Fpaseo.sock",
     );
   });
+
+  it("passes direct TCP connection passwords into the client config", async () => {
+    const mod = await import("./test-daemon-connection");
+
+    const result = await mod.connectToDaemon({
+      id: "direct:lan:6767",
+      type: "directTcp",
+      endpoint: "lan:6767",
+      password: "shared-secret",
+    });
+    await result.client.close();
+
+    expect(daemonClientMock.createdConfigs[0]?.password).toBe("shared-secret");
+  });
+
+  it("surfaces auth rejection as an incorrect password", async () => {
+    const mod = await import("./test-daemon-connection");
+    daemonClientMock.setNextConnectFailure(
+      new Error("Transport closed (code 4001)"),
+      "Transport closed (code 4001)",
+    );
+
+    await expect(
+      mod.connectToDaemon({
+        id: "direct:lan:6767",
+        type: "directTcp",
+        endpoint: "lan:6767",
+        password: "wrong-secret",
+      }),
+    ).rejects.toMatchObject({
+      message: "Incorrect password",
+    });
+  });
+
+  it("keeps generic transport failures generic when a password was supplied", async () => {
+    const mod = await import("./test-daemon-connection");
+    daemonClientMock.setNextConnectFailure(new Error("Transport error"), "Transport error");
+
+    await expect(
+      mod.connectToDaemon({
+        id: "direct:lan:6767",
+        type: "directTcp",
+        endpoint: "lan:6767",
+        password: "shared-secret",
+      }),
+    ).rejects.toMatchObject({
+      message: "Transport error",
+    });
+  });
 });