feat: implement security, discovery, history, file transfer, web UI (P0-P3)

peers.example.toml

@@ -2,13 +2,32 @@
 # Copy this to ~/.config/clip-sync/peers.toml and edit your machines.
 #
 # Environment overrides:
-#   CLIP_SYNC_PORT=9137        override daemon.port
-#   CLIP_SYNC_POLL_MS=500      override daemon.poll_interval_ms
+#   CLIP_SYNC_PORT=9137           override daemon.port
+#   CLIP_SYNC_POLL_MS=500         override daemon.poll_interval_ms
+#   CLIP_SYNC_KEY=...             override security.shared_key
+#   CLIP_SYNC_MAX_BODY_BYTES=...  override daemon.max_body_bytes
 
 [daemon]
 port = 9137
 poll_interval_ms = 500
 
+# Optional features (uncomment to enable):
+# max_body_bytes = 10485760   # 10 MiB request body limit (default)
+# history_size = 50           # number of clipboard history entries
+# discovery = true            # mDNS auto-discovery of peers (no manual peers needed)
+# notify = true               # desktop notifications on incoming clips
+# receive_files = true        # accept incoming file transfers (saved to ~/Downloads/clip-sync)
+# receive_dir = "/path/to/dir"  # override where received files are written
+
+# Optional security (strongly recommended on shared networks):
+# [security]
+# shared_key = "..."          # generate with: clip-sync --generate-key
+# allowed_origins = ["bureau", "portable"]   # reject clips from unknown hosts
+# tls = true                  # encrypt traffic (see clip-sync --generate-cert)
+# cert_file = "~/.config/clip-sync/cert.pem"
+# key_file = "~/.config/clip-sync/key.pem"
+# insecure_skip_verify = true # trust the shared self-signed cert without a CA
+
 [[peers]]
 name = "bureau"
 addr = "192.168.1.10:9137"