TcpTransportFactory

optional hook applied to ktor's TLSConfigBuilder for every transport this factory creates. It runs after the SNI server name is set and before platform trust is configured, so on Android a trust manager installed here is reached through the hostname-aware checkServerTrusted overload rather than bypassing it. Note that installing a trust manager replaces the platform's trust decision — network-security-config anchors, pinning, and Certificate Transparency policy then hold only insofar as that manager enforces them. The wrapping is Android-only and is not subject-name matching; see applyMqttTls for the full picture before relying on it.