Add --no-network option to disable TCP/HTTPS listeners

Allow zenserver to run with only a Unix domain socket for communication
by skipping TCP and HTTPS acceptor creation when --no-network is set.
Useful for sandboxed builds and security-sensitive environments.

Includes CLI option, Lua config binding, validation (requires
--unix-socket, forces asio backend), and integration test. Suppresses
the misleading frontend link log line when no TCP listener is active.

1 files changed, 31 insertions, 0 deletions

diff --git a/src/zenserver-test/zenserver-test.cpp b/src/zenserver-test/zenserver-test.cpp
index 0b2bc50c0..e89812c1f 100644
--- a/src/zenserver-test/zenserver-test.cpp
+++ b/src/zenserver-test/zenserver-test.cpp
@@ -380,6 +380,37 @@ TEST_CASE("http.unixsocket")
 		CHECK(Res.ResponsePayload.GetView().EqualBytes(Body.GetView()));
 	}
 }
+
+TEST_CASE("http.nonetwork")
+{
+	std::filesystem::path TestDir	 = TestEnv.CreateNewTestDir();
+	std::filesystem::path SocketDir	 = TestEnv.CreateNewTestDir();
+	std::string			  SocketPath = (SocketDir / "zen.sock").string();
+
+	ZenServerInstance Instance(TestEnv);
+	Instance.SetDataDir(TestDir);
+	const uint16_t PortNumber = Instance.SpawnServerAndWaitUntilReady(fmt::format("--http=asio --no-network --unix-socket {}", SocketPath));
+
+	// Verify communication works via Unix socket
+	HttpClientSettings Settings;
+	Settings.UnixSocketPath = SocketPath;
+	HttpClient Http{fmt::format("http://localhost:{}", PortNumber), Settings, {}};
+
+	SUBCASE("GET over unix socket succeeds")
+	{
+		HttpClient::Response Res = Http.Get("/testing/hello");
+		CHECK(Res.IsSuccess());
+	}
+
+	SUBCASE("TCP connection is refused")
+	{
+		asio::io_context	  IoContext;
+		asio::ip::tcp::socket Socket(IoContext);
+		asio::error_code	  Ec;
+		Socket.connect(asio::ip::tcp::endpoint(asio::ip::make_address("127.0.0.1"), PortNumber), Ec);
+		CHECK(Ec);	// Expect an error (connection refused)
+	}
+}
 #	endif
 
 TEST_SUITE_END();