Add local-port and public-tunnel reachability checks

README.md

@@ -69,6 +69,7 @@ Routes reload without restarting the service.
 | `tunnel config show` | show API, tunnel, certificate and routes (never the token) |
 | `tunnel route add <port\|host:port> [--name NAME] [--proxy-protocol v1\|v2]` | add/update a route; random name if omitted |
 | `tunnel route remove <name>` / `route list` | manage routes |
+| `tunnel check [name]` | check local TCP targets and the public TLS path |
 | `tunnel up` / `down` | start/stop the background service |
 | `tunnel serve` | run in the foreground |
 | `tunnel status` | local state, daemon, server state and certificate state |
@@ -119,9 +120,13 @@ brew install --cask tzgyn-tunnel-app
 It uses `~/.config/tunnel/config.json` like the CLI, shows tunnel status and
 certificate expiry, routes with copy/open/remove buttons, live logs, settings
 and profile import, and has a start/stop button that runs the service
-in-process. The Settings dialog has **Connect on launch**; add the app to
-macOS Login Items (or the Linux/Windows equivalent) to reconnect at login. If
-the CLI service is already running, a banner offers to stop it first.
+in-process. **Check now** (and an automatic check after connecting) shows
+per-route `local`/`public` health and a summary; “local” is a TCP connect to
+the route target, “public” is a TLS handshake through the real public hostname
+(DNS + proxy + bridge + certificate). The Settings dialog has **Connect on
+launch**; add the app to macOS Login Items (or the Linux/Windows equivalent) to
+reconnect at login. If the CLI service is already running, a banner offers to
+stop it first.
 
 Fyne needs CGO: the macOS build is tested; Linux and Windows must be built on
 those platforms (or with a native CGO cross toolchain), not with