feat: harden control-plane deployment

node-agent/WxAgent.Host/Program.cs

@@ -1033,6 +1033,8 @@ static void PrintHelp() => Console.WriteLine("""
 WxAgent.Host commands:
   serve --config <service.json>
   remote auth show|set|clear --config <remote.json>
+    auth set options: --address <url> --token <token> | --token-file <path> --node <id>
+      [--server-ca-file <pem>] [--client-certificate-file <pem> --client-certificate-key-file <pem>]
   remote status show --config <remote.json> [--data-dir <dir>]
   remote probe run --config <remote.json> [--timeout 60]
   remote reporting show|enable|disable|account-add|account-enable|account-disable|allow|deny --config <remote.json>

node-agent/WxAgent.Host/RemoteCliCommands.cs

@@ -49,7 +49,11 @@ internal static class RemoteCliCommands
         var remote = new RemoteAgentOptions
         {
             AuthAddress = Required(args, "--address"),
-            Token = Required(args, "--token"),
+            Token = Option(args, "--token"),
+            TokenFile = Option(args, "--token-file"),
+            ServerCaFile = Option(args, "--server-ca-file"),
+            ClientCertificateFile = Option(args, "--client-certificate-file"),
+            ClientCertificateKeyFile = Option(args, "--client-certificate-key-file"),
             NodeId = Required(args, "--node"),
             ActiveAccountId = Option(args, "--active-account"),
             AllowInsecureHttp = Has(args, "--allow-insecure-http")
@@ -71,7 +75,7 @@ internal static class RemoteCliCommands
     {
         var configuration = await RemoteNodeConfigurationStore.LoadAsync(path, cancellationToken);
         configuration.Remote.Validate();
-        using var client = new RemoteControlClient(configuration.Remote, new HttpClient { Timeout = TimeSpan.FromSeconds(15) });
+        using var client = new RemoteControlClient(configuration.Remote);
         var accounts = configuration.Reporting.Accounts.Select(account => new RemoteAccountSummary(
             account.AccountId,
             string.Equals(account.AccountId, configuration.Remote.ActiveAccountId, StringComparison.Ordinal),