fix(test): refuse Test Relay in full mode rather than silently apps_script (fix #160)

Issue #160 (deniz_us): Test Relay returned a Google-datacenter IP
even when mode=full and the user's tunnel-node was clearly working
in the browser. The reason: test_cmd::run unconditionally calls
fronter.relay() which is the apps_script-mode path; it doesn't go
through the tunnel mux at all. Result was a worst-of-both-worlds
silent fallback — looked like a successful Test, but the IP it
returned was nothing to do with the user's actual data plane.

Same shape of fix as the existing google_only branch: detect
Mode::Full and return a clear error explaining that Test isn't
wired for full mode, plus how to verify the tunnel-node manually
(whatismyipaddress.com via 127.0.0.1:8085) — at least until a real
full-mode test using the tunnel mux gets implemented.

Following up #160 to track the real fix as an enhancement.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/test_cmd.rs

@@ -28,6 +28,28 @@ pub async fn run(config: &Config) -> bool {
         tracing::error!("{}", msg);
         return false;
     }
+    if matches!(config.mode_kind(), Ok(Mode::Full)) {
+        // Issue #160: Test Relay used to silently fall through to the
+        // apps_script path here, which made it look like the user's
+        // tunnel-node was being used when it wasn't. The probed IP came
+        // back as the Apps Script datacenter — confusing because it
+        // disagreed with what whatismyipaddress.com showed in the
+        // browser (which DOES go through the tunnel). Rather than fake
+        // a passing test, refuse the same way we do for google_only and
+        // tell the user how to actually verify Full mode.
+        let msg = "`mhrv-rs test` is wired only for the apps_script relay \
+                   path. In full mode the data plane is the pipelined \
+                   tunnel mux talking to your tunnel-node — Test Relay \
+                   would bypass that and probe Apps Script directly, \
+                   which is misleading. To verify full mode end-to-end, \
+                   start the proxy and load https://whatismyipaddress.com \
+                   in your browser via 127.0.0.1:8085 (HTTP) or :8086 \
+                   (SOCKS5) — the IP shown should be your tunnel-node's \
+                   VPS IP. Tracking a real Full-mode test in #160.";
+        println!("{}", msg);
+        tracing::error!("{}", msg);
+        return false;
+    }
     let fronter = match DomainFronter::new(config) {
         Ok(f) => f,
         Err(e) => {