2786ae2dde
busauth.LoadCATLSConfig turns a ca.crt path into a *tls.Config trusting only that private CA (clients must pin it; the system roots would reject a self-signed server cert). busauth.ServerTLSConfig loads the server keypair. client.Options gains TLS; NewWithOptions calls nats.Secure when set, so the data-plane connection is encrypted and the server pinned. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>