Rushmote TCP port forwarding — internal development

Connect with Full access, then select TCP ports on the remote session toolbar.
View-only sessions cannot forward ports. Full-access approval and secret access
settings explicitly include TCP ports. Both computers need a supporting build.

Each rule has a listening computer, listen port, destination IPv4 address and
TCP destination port. The destination is reached from the OTHER computer.
Listeners accept connections only from 127.0.0.1 on the selected computer.

Example: ISTA on the technician's computer, vehicle on the customer's LAN:
  App runs on: My computer
  App connects to port: 6801
  Device IP: the vehicle's IPv4 address on the customer's LAN
  Device TCP port: 6801 (or the actual configured destination port)
Then configure the local tool to connect to 127.0.0.1:6801.
Use Remote computer for the opposite direction. All ports are configurable.

Start forwarding opens the app connection port. Stop selected closes that rule and its connections.
Closing the TCP dialog preserves rules for this session. Disconnecting ends all
rules and connections. Rules are not saved or started on the next session.

TCP bytes travel inside the existing authenticated encrypted Rushmote session.
Direct connections and HTTPS relay, including fallback, use the same forwarding
protocol. There is no separate public listening port, UDP discovery or virtual
network adapter. The internal limits are eight rules and 32 TCP connections per
session, with bounded per-connection flow control and connect timeouts.

Both architectures use the same implementation and wire format. Development
fixtures check byte-exact transfers, concurrency, TCP half-close, both listener
directions, permission refusal, malformed frames, limits and disconnect cleanup.
Live backend fixtures also check forwarding over HTTPS and survival of direct
path loss. Actual vehicle/ISTA compatibility requires hardware testing.
