Refactor RDP proxy handling and update related tests

agents/rap-node-agent/internal/mesh/scoped_config.go

@@ -106,6 +106,9 @@ func (cfg ScopedSyntheticConfig) Validate(local PeerIdentity) error {
 		if strings.TrimSpace(nodeID) == "" || strings.TrimSpace(endpoint) == "" {
 			return fmt.Errorf("scoped synthetic mesh config contains empty peer endpoint")
 		}
+		if hasLegacyEndpointScheme(endpoint) {
+			return fmt.Errorf("scoped synthetic mesh config contains non-QUIC peer endpoint")
+		}
 	}
 	for nodeID, candidates := range cfg.PeerEndpointCandidates {
 		if strings.TrimSpace(nodeID) == "" {
@@ -121,6 +124,9 @@ func (cfg ScopedSyntheticConfig) Validate(local PeerIdentity) error {
 				strings.TrimSpace(candidate.ConnectivityMode) == "" {
 				return fmt.Errorf("scoped synthetic mesh config contains invalid peer endpoint candidate")
 			}
+			if !isQUICOnlyCandidateTransport(candidate.Transport) || hasLegacyEndpointScheme(candidate.Address) {
+				return fmt.Errorf("scoped synthetic mesh config contains non-QUIC peer endpoint candidate")
+			}
 		}
 	}
 	for endpointID, observation := range cfg.PeerEndpointObservations {
@@ -179,6 +185,14 @@ func validatePeerDirectory(entries []PeerDirectoryEntry, localNodeID string) err
 	return nil
 }
 
+func hasLegacyEndpointScheme(endpoint string) bool {
+	endpoint = strings.ToLower(strings.TrimSpace(endpoint))
+	return strings.HasPrefix(endpoint, "http://") ||
+		strings.HasPrefix(endpoint, "https://") ||
+		strings.HasPrefix(endpoint, "ws://") ||
+		strings.HasPrefix(endpoint, "wss://")
+}
+
 func validateRecoverySeeds(seeds []PeerRecoverySeed) error {
 	if len(seeds) > 20 {
 		return fmt.Errorf("scoped synthetic mesh config contains too many recovery seeds")
@@ -191,6 +205,9 @@ func validateRecoverySeeds(seeds []PeerRecoverySeed) error {
 			strings.TrimSpace(seed.Transport) == "" {
 			return fmt.Errorf("scoped synthetic mesh config contains invalid recovery seed")
 		}
+		if !isQUICOnlyCandidateTransport(seed.Transport) || hasLegacyEndpointScheme(seed.Endpoint) {
+			return fmt.Errorf("scoped synthetic mesh config contains non-QUIC recovery seed")
+		}
 		if _, duplicate := seen[key]; duplicate {
 			return fmt.Errorf("scoped synthetic mesh config contains duplicate recovery seed")
 		}
@@ -224,6 +241,9 @@ func validateRendezvousLeases(leases []PeerRendezvousLease, routes []SyntheticRo
 			(len(lease.Metadata) > 0 && !json.Valid(lease.Metadata)) {
 			return fmt.Errorf("scoped synthetic mesh config contains invalid rendezvous lease")
 		}
+		if !isQUICOnlyCandidateTransport(lease.Transport) || hasLegacyEndpointScheme(lease.RelayEndpoint) {
+			return fmt.Errorf("scoped synthetic mesh config contains non-QUIC rendezvous lease")
+		}
 		if _, duplicate := seen[lease.LeaseID]; duplicate {
 			return fmt.Errorf("scoped synthetic mesh config contains duplicate rendezvous lease")
 		}