Go layer (c-archive) provides a localhost TCP proxy through a WireGuard tunnel.
Flutter connects gRPC to localhost:PORT, Go forwards via tsnet to heater's Tailscale IP.
No VPN entitlement needed — uses userspace netstack.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>