feat: expose controller through decky backend

Prepare signs in on load (never connects), system CA bundle for HTTPS,
root-owned deploy extraction.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/test_client.py

@@ -24,6 +24,22 @@ class FakeTransport:
         return [c for c in self.calls if c[0] == method and c[1] == url]
 
 
+class SslContextTest(unittest.TestCase):
+    def test_uses_first_existing_system_bundle(self):
+        import ssl
+        from mudfish_decky.client import ssl_context
+        loaded = []
+
+        class Ctx:
+            def load_verify_locations(self, cafile):
+                loaded.append(cafile)
+
+        ctx = ssl_context(["/nope/a.pem", __file__, "/nope/b.pem"], factory=lambda: Ctx())
+        self.assertIsInstance(ctx, Ctx)
+        self.assertEqual(loaded, [__file__])
+        self.assertIsInstance(ssl_context([], factory=ssl.create_default_context), ssl.SSLContext)
+
+
 class ClientTest(unittest.TestCase):
     def test_ensure_signed_in_noop_when_signed(self):
         t = FakeTransport({("GET", BASE + "/do/mudrun/status"): [dict(SIGNED_OUT, isSignedIn=True)]})

tests/test_controller.py

@@ -238,6 +238,22 @@ class ControllerTest(unittest.TestCase):
         self.assertEqual(st["node_mode"], "auto")
         self.assertEqual(st["node"]["sid"], 11)
 
+    def test_prepare_signs_in_and_caches_nodes_without_starting(self):
+        self.client.st["isSignedIn"] = False
+        signed = []
+        self.client.ensure_signed_in = lambda: signed.append(1) or dict(self.client.st, isSignedIn=True)
+        c = self.make()
+        c.prepare()
+        self.assertEqual(self.system.daemon_calls, 1)
+        self.assertEqual(signed, [1])
+        self.assertEqual(self.client.start_calls, 0)
+        self.assertEqual([n["sid"] for n in Store(self.path).load()["static_nodes"]], [9, 11, 46, 300])
+
+    def test_prepare_tolerates_signin_failure(self):
+        self.client.signin_error = SigninError("401")
+        self.make().prepare()
+        self.assertEqual(self.client.start_calls, 0)
+
     def test_nodes_lists_japan_by_ping(self):
         self.assertEqual([n["sid"] for n in self.make().nodes()], [11, 9, 46])