<?xml version="1.0" encoding="utf-8"?>
<!-- STUB (plan §8 / A19). Cleartext is OFF globally. A19 will add
     <domain-config cleartextTrafficPermitted="true"> entries for the private-LAN
     and Tailscale CIDRs that legitimately need ws:// (10/8, 172.16/12,
     192.168/16, 100.64/10). Tunnel (*.terminal.yaojia.wang) and Tailscale
     MagicDNS hosts present real LE certs and use default system trust (§6.9),
     so they stay under this base-config. -->
<network-security-config>
    <base-config cleartextTrafficPermitted="false" />
</network-security-config>
