Fix TLS code review issues: SSL cleanup, TLS 1.2 min, CA verify, deprecation guards, server --help, port validation, __thread io_ssl, shared accept loop

src/client/client_cli.c

@@ -1,6 +1,7 @@
 #include "client_send.h"
 #include "config.h"
 #include "log.h"
+#include "transport_tls.h"
 #include "utils.h"
 #include <stdio.h>
 #include <stdlib.h>
@@ -45,6 +46,7 @@ static void print_usage(void) {
   printf("  --tls               Enable TLS encryption\n");
   printf("  --cert <path>       TLS certificate file (PEM)\n");
   printf("  --key <path>        TLS private key file (PEM)\n");
+  printf("  --ca <path>         TLS CA certificate file (PEM)\n");
   printf("  --help              Show this help\n");
 }
 
@@ -144,6 +146,9 @@ int main(int argc, char *argv[]) {
     } else if (strcmp(argv[i], "--key") == 0 && i + 1 < argc) {
       free(config->tls_key);
       config->tls_key = str_dup(argv[++i]);
+    } else if (strcmp(argv[i], "--ca") == 0 && i + 1 < argc) {
+      free(config->tls_ca);
+      config->tls_ca = str_dup(argv[++i]);
     } else if (strcmp(argv[i], "-v") == 0 || strcmp(argv[i], "--verbose") == 0) {
       set_log_level(LOG_LEVEL_DEBUG);
     } else if (argv[i][0] == '-') {
@@ -195,6 +200,14 @@ int main(int argc, char *argv[]) {
     return 1;
   }
 
+  if (config->use_tls) {
+    if (!config->tls_cert || !config->tls_key) {
+      fprintf(stderr, "Error: --tls requires --cert and --key\n");
+      return 1;
+    }
+    tls_global_init();
+  }
+
   if (config->use_multithreading)
     return send_files_multithreaded(config);
   return send_files(config);