Add direct connect, auto-detect PKI, and rework demo flow

- connectDirect(policy, mode): connect without endpoint discovery,
  for servers with no unencrypted endpoint. Sets user identity token
  policy matching the auth mode.
- autoDetectPki(): scan own/certs/*.der and own/private/*.pem|crt,
  called automatically at startup.
- Demo: discovery auto-starts, PKI section hidden behind toggle with
  auto-detected cert summary, direct connect appears on connect failure.
  File/folder dialogs for manual PKI override.

1 files changed, 131 insertions, 14 deletions

diff --git a/demo/Main.qml b/demo/Main.qml
index 5609c12..fe4f369 100644
--- a/demo/Main.qml
+++ b/demo/Main.qml
@@ -3,14 +3,23 @@
 import QtQuick
 import QtQuick.Controls
 import QtQuick.Layouts
+import QtQuick.Dialogs
 import Bobink
 
 ApplicationWindow {
     width: 600
-    height: 600
+    height: 800
     visible: true
     title: "Bobink Demo"
 
+    property bool autoConnectFailed: false
+    property bool showPkiSettings: false
+
+    Component.onCompleted: {
+        BobinkClient.discoveryUrl = discoveryUrlField.text
+        BobinkClient.startDiscovery()
+    }
+
     Connections {
         target: BobinkClient
         function onServersChanged() {
@@ -18,9 +27,12 @@ ApplicationWindow {
         }
         function onConnectedChanged() {
             console.log("Connected:", BobinkClient.connected)
+            if (BobinkClient.connected)
+                autoConnectFailed = false
         }
         function onConnectionError(message) {
             console.log("Connection error:", message)
+            autoConnectFailed = true
         }
         function onDiscoveringChanged() {
             console.log("Discovering:", BobinkClient.discovering)
@@ -92,42 +104,96 @@ ApplicationWindow {
             ScrollBar.vertical: ScrollBar {}
         }
 
-        Label { text: "PKI"; font.bold: true }
+        RowLayout {
+            Label { text: "PKI"; font.bold: true }
+            Label {
+                text: BobinkClient.certFile
+                      ? "  (" + BobinkClient.certFile.split("/").pop() + ")"
+                      : "  (no certificate found)"
+                font.italic: true
+                color: BobinkClient.certFile ? "green" : "gray"
+            }
+            Item { Layout.fillWidth: true }
+            Button {
+                text: showPkiSettings ? "Hide" : "Configure..."
+                flat: true
+                onClicked: showPkiSettings = !showPkiSettings
+            }
+        }
+
+        FileDialog {
+            id: certFileDialog
+            title: "Select Certificate"
+            currentFolder: "file://" + trustFolderField.text
+            nameFilters: ["DER certificates (*.der)", "All files (*)"]
+            onAccepted: certFileField.text = selectedFile.toString().replace("file://", "")
+        }
+
+        FileDialog {
+            id: keyFileDialog
+            title: "Select Private Key"
+            currentFolder: "file://" + trustFolderField.text
+            nameFilters: ["Key files (*.pem *.crt)", "All files (*)"]
+            onAccepted: keyFileField.text = selectedFile.toString().replace("file://", "")
+        }
+
+        FolderDialog {
+            id: trustFolderDialog
+            title: "Select Trust Folder"
+            currentFolder: "file://" + trustFolderField.text
+            onAccepted: trustFolderField.text = selectedFolder.toString().replace("file://", "")
+        }
 
         GridLayout {
-            columns: 2
+            columns: 3
             Layout.fillWidth: true
+            visible: showPkiSettings
 
-            Label { text: "PKI directory:" }
-            TextField {
-                id: pkiDirField
-                Layout.fillWidth: true
-                text: BobinkClient.pkiDir
-                onEditingFinished: BobinkClient.pkiDir = text
-            }
             Label { text: "Certificate:" }
             TextField {
                 id: certFileField
                 Layout.fillWidth: true
-                placeholderText: "/path/to/cert.der"
+                text: BobinkClient.certFile
+                placeholderText: "Client certificate (.der)"
             }
+            Button {
+                text: "Browse..."
+                onClicked: certFileDialog.open()
+            }
+
             Label { text: "Private key:" }
             TextField {
                 id: keyFileField
                 Layout.fillWidth: true
-                placeholderText: "/path/to/key.pem"
+                text: BobinkClient.keyFile
+                placeholderText: "Private key (.pem, .crt)"
+            }
+            Button {
+                text: "Browse..."
+                onClicked: keyFileDialog.open()
+            }
+
+            Label { text: "Trust folder:" }
+            TextField {
+                id: trustFolderField
+                Layout.fillWidth: true
+                text: BobinkClient.pkiDir
+            }
+            Button {
+                text: "Browse..."
+                onClicked: trustFolderDialog.open()
             }
         }
 
         Button {
             text: "Apply PKI"
             Layout.fillWidth: true
+            visible: showPkiSettings
             onClicked: {
-                BobinkClient.pkiDir = pkiDirField.text
+                BobinkClient.pkiDir = trustFolderField.text
                 BobinkClient.certFile = certFileField.text
                 BobinkClient.keyFile = keyFileField.text
                 BobinkClient.applyPki()
-                console.log("PKI applied:", BobinkClient.pkiDir)
             }
         }
 
@@ -206,6 +272,7 @@ ApplicationWindow {
                 if (BobinkClient.connected) {
                     BobinkClient.disconnectFromServer()
                 } else {
+                    autoConnectFailed = false
                     BobinkClient.auth = auth
                     BobinkClient.serverUrl = serverUrlField.text
                     BobinkClient.connectToServer()
@@ -214,6 +281,56 @@ ApplicationWindow {
         }
 
         Label {
+            text: "Direct Connect"
+            font.bold: true
+            visible: autoConnectFailed && !BobinkClient.connected
+        }
+
+        GridLayout {
+            columns: 2
+            Layout.fillWidth: true
+            visible: autoConnectFailed && !BobinkClient.connected
+
+            Label { text: "Security policy:" }
+            ComboBox {
+                id: securityPolicyCombo
+                Layout.fillWidth: true
+                textRole: "text"
+                valueRole: "policy"
+                model: [
+                    { text: "Basic256Sha256", policy: BobinkClient.Basic256Sha256 },
+                    { text: "Aes128-Sha256-RsaOaep", policy: BobinkClient.Aes128_Sha256_RsaOaep },
+                    { text: "Aes256-Sha256-RsaPss", policy: BobinkClient.Aes256_Sha256_RsaPss }
+                ]
+            }
+
+            Label { text: "Security mode:" }
+            ComboBox {
+                id: securityModeCombo
+                Layout.fillWidth: true
+                textRole: "text"
+                valueRole: "mode"
+                model: [
+                    { text: "Sign & Encrypt", mode: BobinkClient.SignAndEncrypt },
+                    { text: "Sign", mode: BobinkClient.Sign },
+                    { text: "None", mode: BobinkClient.None }
+                ]
+            }
+        }
+
+        Button {
+            text: "Direct Connect"
+            Layout.fillWidth: true
+            visible: autoConnectFailed && !BobinkClient.connected
+            onClicked: {
+                BobinkClient.auth = auth
+                BobinkClient.serverUrl = serverUrlField.text
+                BobinkClient.connectDirect(securityPolicyCombo.currentValue,
+                                           securityModeCombo.currentValue)
+            }
+        }
+
+        Label {
             text: "Status: " + (BobinkClient.connected ? "Connected" : "Disconnected")
             color: BobinkClient.connected ? "green" : "red"
         }