Require TLS or authentication for non-loopback mecated binds

Summary

mecated currently allows the gRPC and HTTP/SSE listeners to bind to non-loopback addresses without TLS or request authentication. It emits a warning, but still starts the server.

A non-loopback listener exposes powerful capabilities, including command execution and file access, to the network. The server should fail closed unless the operator explicitly configures a secure transport or authentication mechanism.

Current behavior

When --grpc-addr or --http-addr is set to a non-loopback address:

• TLS is optional.
• Bearer authentication is optional.
• If neither is configured, mecated starts and logs a warning.
• mecatui already refuses to send bearer tokens over cleartext to non-loopback targets.

Relevant implementation:

• cmd/mecated/main.go — warnIfNonLoopback
• cmd/mecated/main.go — buildEdge
• cmd/mecatui/client/client.go — cleartext bearer-token guard

Proposed behavior

For each gRPC and HTTP/SSE listener independently:

• Loopback binds continue to allow the current plaintext development path.
• Non-loopback binds require at least one of:
  • server TLS configured with --tls-cert and --tls-key;
  • bearer authentication configured with --auth-token / MECATL_AUTH_TOKEN;
  • OIDC authentication configured.
• If a non-loopback listener has neither TLS nor authentication, startup fails with an actionable error.
• The existing warning should become an error for this unsafe posture.
• TLS remains explicit; do not infer TLS from the port or address.
• Existing reverse-proxy/service-mesh deployments should be considered when choosing the configuration escape hatch.

Example error:

refusing non-loopback gRPC listener 0.0.0.0:8080 without TLS or authentication; configure --tls-cert/--tls-key, --auth-token, or OIDC

Acceptance criteria

• A non-loopback gRPC listener without TLS, bearer auth, or OIDC fails startup.
• A non-loopback HTTP/SSE listener without TLS, bearer auth, or OIDC fails startup.
• A loopback listener without TLS or authentication continues to start.
• A non-loopback listener with TLS starts successfully.
• A non-loopback listener with bearer authentication starts successfully.
• A non-loopback listener with OIDC authentication starts successfully.
• gRPC and HTTP/SSE listeners are checked independently.
• The startup error identifies the affected listener and explains how to fix it.
• Existing cleartext bearer-token client protection remains intact.
• Unit tests cover the accepted and rejected security postures.
• User-facing operator documentation describes the new startup requirement and the loopback exception.
• Docker/container deployment guidance explains that Docker networking does not provide application-level TLS and documents the certificate, authentication, or reverse-proxy options.

Non-goals

• Automatically enabling or autodetecting TLS.
• Generating certificates automatically.
• Requiring mutual TLS for every remote deployment.
• Removing the loopback plaintext development experience.
• Changing the security policy for remote store-driver connections.

Start in cmd/mecated/main.go at warnIfNonLoopback and buildEdge, then inspect cmd/mecatui/client/client.go for the existing cleartext bearer-token guard. Add independent startup checks and unit tests for the listed listener security postures, preserving loopback behavior. Done includes actionable errors and operator and Docker deployment documentation covering TLS, authentication, and reverse-proxy options.