Add authorized TCP pipe forwarding

docs/roadmap.md

@@ -369,14 +369,21 @@ Goal: add authorized stream-oriented management workflows over Iroh.
   - `[x]` `geth pipe recv <name>` drains daemon-lifetime pipe messages.
   - `[x]` Remote pipe send requires `pipe.connect` on
     `resource:pipe:<name>`.
-  - `[ ]` Pipe connect carries bidirectional byte streams over Iroh.
-  - `[ ]` Streams close cleanly and propagate errors.
+  - `[x]` TCP forwarding carries bidirectional byte streams over Iroh.
+  - `[x]` TCP streams close cleanly and propagate errors through the local
+    forwarder logs.
 
-- `[ ]` TCP forwarding.
+- `[~]` TCP forwarding.
   Acceptance criteria:
-  - A local TCP listener can forward over an authorized Iroh pipe.
-  - Tests cover basic request/response forwarding.
-  - Forwarding is resource-scoped and can be disabled by auth.
+  - `[x]` A local loopback TCP listener can forward over an authorized Iroh
+    pipe with `geth pipe forward-tcp`.
+  - `[x]` The remote side connects only to explicit loopback socket addresses
+    in the prototype.
+  - `[x]` Forwarding is resource-scoped with `pipe.forward` on
+    `resource:pipe-tcp:<target>`.
+  - `[x]` Tests cover address validation and TCP pipe wire
+    request/response serialization.
+  - `[ ]` Tests cover a full two-node request/response forwarding exchange.
 
 - `[ ]` Unix socket forwarding where supported.
   Acceptance criteria: