Fix demo mode: install rustls CryptoProvider, skip TLS, add ARC_DEMO env var

- Install ring CryptoProvider at CLI startup to prevent rustls panic
- Skip TLS in demo mode so the server uses plain HTTP
- Add ARC_DEMO=1 env var to web app config to bypass GitHub OAuth

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Cargo.lock

@@ -196,6 +196,7 @@ dependencies = [
  "rand 0.8.5",
  "regex",
  "reqwest 0.12.28",
+ "rustls",
  "rustls-pemfile",
  "semver",
  "serde_json",

apps/arc-web/app/lib/config.server.ts

@@ -68,13 +68,19 @@ function loadAppConfig(): AppConfig {
   const rawApi = (raw.api ?? {}) as Partial<ApiConfig>;
   const rawGit = (raw.git ?? {}) as Partial<GitConfig>;
 
+  const demo = process.env.ARC_DEMO === "1";
+
   return {
     web: {
       ...WEB_DEFAULTS,
       url: (rawWeb.url as string) ?? WEB_DEFAULTS.url,
-      auth: { ...AUTH_DEFAULTS, ...rawWebAuth },
+      auth: demo
+        ? { provider: "insecure_disabled", allowed_usernames: [] }
+        : { ...AUTH_DEFAULTS, ...rawWebAuth },
     },
-    api: { ...API_DEFAULTS, ...rawApi },
+    api: demo
+      ? { ...API_DEFAULTS, authentication_strategy: "insecure_disabled" }
+      : { ...API_DEFAULTS, ...rawApi },
     git: { ...GIT_DEFAULTS, ...rawGit },
   };
 }

crates/arc-api/src/serve.rs

@@ -154,8 +154,8 @@ pub async fn serve_command(args: ServeArgs, styles: &'static Styles) -> anyhow::
         eprintln!("{}", styles.dim.apply_to("(dry-run mode)"));
     }
 
-    // Branch: TLS or plain HTTP
-    if let Some(ref tls_config) = server_config.api.tls {
+    // Branch: TLS or plain HTTP (demo mode always uses plain HTTP)
+    if let (false, Some(ref tls_config)) = (args.demo, &server_config.api.tls) {
         let client_auth = client_auth.unwrap();
 
         let rustls_config = crate::tls::build_rustls_config(tls_config, client_auth);

crates/arc-cli/Cargo.toml

@@ -32,6 +32,7 @@ semver.workspace = true
 reqwest.workspace = true
 jsonwebtoken.workspace = true
 base64.workspace = true
+rustls = { version = "0.23", default-features = false, features = ["std", "ring"] }
 rustls-pemfile = "2"
 x509-parser = "0.16"
 rand.workspace = true

crates/arc-cli/src/main.rs

@@ -78,6 +78,8 @@ enum LlmCommand {
 
 #[tokio::main]
 async fn main() -> Result<()> {
+    let _ = rustls::crypto::ring::default_provider().install_default();
+
     let cli = Cli::parse();
     if !cli.no_dotenv {
         if let Some(home) = dirs::home_dir() {