[kacy]

gRPC only served plaintext. A server configured with tls-port encrypted RESP but still served the same data in the clear on the gRPC port, 6380 by default. The Docker image binds it to 0.0.0.0.

• TLS for gRPC: when tls-port is set, gRPC uses the same certificate, key and client certificate settings, plus ALPN h2. The rustls config is split out of load_tls_acceptor so both acceptors share it
• No new dependencies: tonic's own TLS support is behind a feature, so grpc::tls::incoming accepts connections and runs our existing handshake (with its 10 s timeout) in a task per connection. It hands the streams to serve_with_incoming. The wrapper reports TcpConnectInfo, so protected mode still sees the peer address
• Port clash: the server refuses to start when the TLS port and the gRPC port are the same. The checklist's TLS example used 6380, the gRPC default, and now uses 6381

Tests:

• a plaintext client gets no answer from gRPC on a TLS server, and a TLS client with ALPN h2 gets PONG. The test connects through tonic's custom connector, using hyper-util and tower, which tonic already depends on
• the port clash check