feat(const): protocol config keys + ports; connection manager generates missing certs before protocol start

tests/test_protocol_transport.py

@@ -99,7 +99,7 @@ class TestPushCallbackWiring:
         notified = []
         manager.register_listener(lambda: notified.append(True))
 
-        manager._start_protocol()
+        await manager._start_protocol()
         client.push_is_on(True)
         client.push_is_available(False)
         await _drain_loop()
@@ -114,7 +114,7 @@ class TestPushCallbackWiring:
     async def test_current_app_push_stored_raw_package(self):
         client = FakeProtocolClient()
         manager = _protocol_manager(client)
-        manager._start_protocol()
+        await manager._start_protocol()
         client.push_current_app("com.netflix.ninja")
         await _drain_loop()
         assert manager.current_app == "com.netflix.ninja"  # name resolution deferred
@@ -123,7 +123,7 @@ class TestPushCallbackWiring:
     async def test_volume_push_normalized_to_level_max_muted(self):
         client = FakeProtocolClient()
         manager = _protocol_manager(client)
-        manager._start_protocol()
+        await manager._start_protocol()
         client.push_volume_info({"level": 7, "max": 15, "muted": True})
         await _drain_loop()
         assert manager.volume_info == (7.0, 15.0, True)
@@ -138,7 +138,7 @@ class TestInvalidAuthHook:
         manager = _protocol_manager(
             client, invalid_auth_callback=lambda: fired.append(True)
         )
-        manager._start_protocol()
+        await manager._start_protocol()
 
         client.fire_invalid_auth()
 
@@ -148,7 +148,7 @@ class TestInvalidAuthHook:
     async def test_invalid_auth_without_callback_is_safe(self):
         client = FakeProtocolClient()
         manager = _protocol_manager(client)
-        manager._start_protocol()
+        await manager._start_protocol()
         client.fire_invalid_auth()  # no callback registered — must not raise
         await manager.async_stop()
 
@@ -159,7 +159,7 @@ class TestLifecycle:
         tears it down — the manager never wraps that task itself."""
         client = FakeProtocolClient()
         manager = _protocol_manager(client)
-        manager._start_protocol()
+        await manager._start_protocol()
         task = client._reconnect_task
         assert task is not None
 
@@ -189,7 +189,7 @@ class TestLifecycle:
                 "keyfile": "/tmp/key.pem",
             },
         )
-        manager._start_protocol()
+        await manager._start_protocol()
 
         assert manager._protocol is client
         assert built
@@ -202,7 +202,7 @@ class TestLifecycle:
 
     async def test_passive_without_protocol_configuration(self):
         manager = _protocol_manager(client=None)
-        manager._start_protocol()  # no factory, no settings → no-op
+        await manager._start_protocol()  # no factory, no settings → no-op
 
         assert manager._protocol is None
         assert manager.is_on is None
@@ -220,7 +220,7 @@ class TestPushEdgeCases:
         notified = []
         manager.register_listener(lambda: notified.append(True))
 
-        manager._start_protocol()
+        await manager._start_protocol()
 
         loop = asyncio.new_event_loop()
         loop.close()
@@ -238,7 +238,7 @@ class TestPushEdgeCases:
         store = StateStore(ttl=60.0, clock=lambda: now[0])
         client = FakeProtocolClient()
         manager = _protocol_manager(client, store=store)
-        manager._start_protocol()
+        await manager._start_protocol()
         client.push_is_on(True)
         await _drain_loop()
 
@@ -250,7 +250,7 @@ class TestPushEdgeCases:
     async def test_pushes_are_stamped_with_transition_time(self):
         client = FakeProtocolClient()
         manager = _protocol_manager(client)
-        manager._start_protocol()
+        await manager._start_protocol()
         before = time.monotonic()
         client.push_is_available(True)
         await _drain_loop()