fix(nats): apply TLS replica options

[corylanou]

Summary

Apply every NATS replica TLS setting when constructing the NATS client options.

Problem

The tls: YAML setting parsed successfully but was dropped by newNATSReplicaClientFromConfig(). The NATS client also no longer added nats.Secure() for explicit TLS after PR #720 replaced the original TLS branch with certificate helpers.

Before the fix, the regression test failed with:

TestNewNATSReplicaFromConfig_TLS: TLS=false, want true

Root CA and client certificate settings still auto-enabled TLS, which masked the missing explicit TLS path.

Solution

• Propagate the parsed TLS flag to the NATS replica client.
• Build connection options in a testable helper.
• Add nats.Secure() when explicit TLS is enabled.
• Verify explicit TLS, root CA, and client certificate options independently.

Scope

In scope:

• NATS replica TLS option propagation
• Unit coverage for all supported NATS TLS settings

Not in scope:

• NATS server configuration changes
• New TLS configuration fields
• Changes to other replica backends

Test Plan

go test -race ./cmd/litestream ./nats -run '^(TestNewNATSReplicaFromConfig_TLS|TestReplicaClient_options_TLS)$' -count=1
go test -race -v ./...
go vet ./...
pre-commit run --all-files

Related

Fixes #1352

[github-actions]

PR Build Metrics

✅ All clear — no issues detected

Check	Status	Summary
Binary size	✅	36.95 MB (0.0 KB / 0.00%)
Dependencies	✅	No changes
Vulnerabilities	✅	None detected
Go toolchain	✅	1.25.12 (latest)
Module graph	✅	1240 edges (0)

Binary Size

	Size	Change
Base (c96c0f4)	36.95 MB
PR (b9a4702)	36.95 MB	0.0 KB (0.00%)

Dependency Changes

No dependency changes.

govulncheck Output

=== Symbol Results ===

No vulnerabilities found.

Your code is affected by 0 vulnerabilities.
This scan also found 0 vulnerabilities in packages you import and 1
vulnerability in modules you require, but your code doesn't appear to call these
vulnerabilities.
Use '-show verbose' for more details.

Build Info

Metric	Value
Build time	42s
Go version	go1.25.12
Commit	b9a4702

History (1 previous)

Commit	Updated	Status	Summary
1a3c998	2026-07-10 19:58 UTC	✅	36.95 MB (0.0 KB / 0.00%)

---

_{🤖 Updated on each push.}