fix(zmq): add authenticated encrypted transport mode

[rylinjames]

Summary

• add optional CurveZMQ server/client configuration using pyzmq certificate files
• require an optional control token for built-in ZMQ control endpoints (ping, kill)
• wire secure ZMQ flags through tether serve and document certificate generation/client setup
• cover token-gated control endpoints, CURVE handshake, client token forwarding, and factory compatibility

Tests

• /Users/romirjain/Desktop/building\ projects/fastcrest/tether/.venv/bin/ruff check src/tether/runtime/transports/zmq/policy_server.py src/tether/runtime/transports/zmq/client.py src/tether/runtime/transports/zmq/factory.py src/tether/runtime/transports/zmq/security.py tests/test_zmq_policy_server.py tests/test_zmq_client.py
• PYTHONPATH=$PWD/src /Users/romirjain/Desktop/building\ projects/fastcrest/tether/.venv/bin/python -m py_compile src/tether/runtime/transports/zmq/policy_server.py src/tether/runtime/transports/zmq/client.py src/tether/runtime/transports/zmq/factory.py src/tether/runtime/transports/zmq/security.py src/tether/cli.py
• PYTHONPATH=$PWD/src /Users/romirjain/Desktop/building\ projects/fastcrest/tether/.venv/bin/python -m pytest tests/test_zmq_policy_server.py tests/test_zmq_client.py tests/test_zmq_factory.py -p no:cacheprovider

Note: installed optional [serve] transport deps (msgpack, pyzmq, opencv-python-headless) into the local venv to run these tests.

🤖 Generated with Claude Code