feat(demo): add backend security controls

[rchatham]

Summary

• Add backend-specific Security controls to the expanded demo while keeping connection behavior independent.
• Map MultipeerConnectivity to Compatible/Optional Encryption or Require Encryption.
• Map Network.framework to Unauthenticated or TLS Shared Key.
• Validate Network PSKs as strict Base64 with at least 32 decoded bytes and fail closed without plaintext fallback.
• Generate in-memory 32-byte test keys with SecRandomCopyBytes and surface generation failures.
• Document the actual trust boundaries: Multipeer encryption does not authenticate peers with the demo's nil identity/accept-all certificates; Network TLS-PSK authenticates group membership, not individual identity.
• Add DemoSecurityAndInteroperabilityPlan.md; interoperability remains report-only because the backends use incompatible discovery, transport, framing, identity, invitation, and security protocols.

Security behavior

• Security selections are remembered per backend and disabled while networking runs.
• Invalid, empty, malformed, or short TLS keys block Start; they never downgrade to .unauthenticated.
• PCNetworkPSKBase64 is DEBUG-only and uses the same strict validator. Process arguments are documented as unsuitable for production secrets.
• Key material is excluded from logs, exported logs, status text, accessibility values, and screenshots.
• Stop preserves the current in-memory test key for restart; Reset drops its references. Swift does not guarantee secure erasure.
• Invitation behavior remains independently selectable as Automatic or Require Invitation.

Verification

• swift test — 161 tests passed.
• xcodebuild test -project PeerConnectivity.xcodeproj -scheme PeerConnectivity -destination 'platform=iOS Simulator,name=iPhone 16,OS=18.3.1' -configuration Debug — 161 tests passed.
• Demo iPhone 16 / iOS 18.3.1 build passed.
• Matching TLS-PSK simulator instances started and discovered one another.
• Existing loopback tests cover matching-key message exchange and mismatched-key rejection.
• Correctness review: no merge-blocking findings.
• Security review: no merge-blocking security findings.

Screenshots

Multipeer security	Network TLS shared key

Limitations

• Multipeer required encryption is not peer authentication in this demo and remains vulnerable to active man-in-the-middle attacks.
• Network TLS-PSK identifies group membership only; a key holder can self-assert another peer identity.
• MultipeerConnectivity and Network.framework peers cannot directly interoperate. A future dual-stack bridge would be a separate trusted gateway design, not wire compatibility.
• Physical-device Multipeer required-encryption testing and the complete interactive connection-behavior matrix remain part of manual release validation.

[Copilot]

Pull request overview

Adds demo-facing security controls for both MultipeerConnectivity and Network.framework backends, while keeping the demo’s connection-behavior selection independent. This fits the project’s “demo as a validated reference implementation” role by surfacing existing backend security modes and documenting their real trust boundaries (encryption vs authentication) without changing the public library API.

Changes:

• Introduces strict Base64 (no whitespace) TLS-PSK validation with a 32+ decoded-byte minimum and a test-key generator backed by SecRandomCopyBytes.
• Updates the demo UI to select backend-specific security modes, validate TLS-PSK inputs before Start, and avoid exposing key material in logs/status/accessibility.
• Expands documentation to describe demo security behavior and explicitly states that Multipeer and Network backends are not wire-compatible (interop remains report-only).

Reviewed changes

Copilot reviewed 10 out of 12 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
Sources/PeerNetworkPSKConfiguration.swift	Maps validated Base64 PSK input into .preSharedKey network security configuration.
Sources/PeerNetworkPSKBase64.swift	Adds strict Base64 decode/length validation and in-memory test key generation.
PeerConnectivityTests/PeerNetworkPSKBase64Tests.swift	Adds focused unit tests for strict PSK validation, fail-closed mapping, and key generation success/failure.
PeerConnectivityDemo/ViewController.swift	Adds backend-specific security UI, PSK entry/generation, validation gating for Start, and updated status/log messaging.
PeerConnectivityDemo/README.md	Documents demo security modes, PSK handling/validation, and debug-only launch argument behavior.
README.md	Updates top-level demo instructions to include backend-specific security and non-interop note.
NetworkBackendGuide.md	Updates demo section to include security modes, strict PSK validation, and debug argument.
DemoSecurityAndInteroperabilityPlan.md	Adds plan/ADR-style doc for demo security UI and backend interoperability assessment (report-only).
PeerConnectivityDemo.xcodeproj/project.pbxproj	Adds new PSK helper sources to the demo target build.
PeerConnectivity.xcodeproj/project.pbxproj	Adds new PSK helper sources + tests to the library project build.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[rchatham]

Superseded by consolidated PR #56. No commits were discarded; this branch is preserved as a recovery and reference point. Addressed review findings were replied to and resolved before consolidation.