feat: show protocol and access policy in zt list / zt status

Neither was visible without running `zt status` per tunnel one at a
time (protocol) or not at all (access policy) — for a security tool,
whether a given tunnel is public or gated behind Zero Trust is
exactly the kind of thing that should be visible at a glance across
all tunnels, not just discoverable per-tunnel.

- cmd/zt/list.go: new accessLabel() ("public" in yellow, or
  "ZT (N email(s))" in green); PROTOCOL and ACCESS columns added to
  `zt list`'s table (reusing the existing protocolLabel() helper)
  and as a new "Access:" line in `zt status`
- README.md: updated the zt list/zt status example output to match

Author: casablanque-code

README.md

@@ -309,9 +309,9 @@ zt list      # or: zt ls
 ```
 
 ```
-NAME        URL                             PORT   STATUS   MANAGED BY
-portainer   https://portainer.example.com   9000   running  systemd
-grafana     https://grafana.example.com     3000   stopped  pid 84291
+NAME        URL                             PORT   PROTOCOL      ACCESS         STATUS   MANAGED BY
+portainer   https://portainer.example.com   9000   auto (quic)   ZT (1 email)   running  systemd
+grafana     https://grafana.example.com     3000   http2 (TCP)   public         stopped  pid 84291
 ```
 
 ### Tunnel details
@@ -326,8 +326,9 @@ zt status portainer
   Port:       9000
   Tunnel ID:  07fc193d-d05e-48eb-bb00-22be71823b14
   Managed by: systemd
-  Status:     running
   Protocol:   http2 (TCP)
+  Access:     ZT (1 email)
+  Status:     running
   Created:    2026-05-27 00:01:08
   Log:        /root/.zt/tunnels/portainer/cloudflared.log
 ```

cmd/zt/list.go

@@ -237,7 +237,7 @@ func runList(cmd *cobra.Command, args []string) error {
 	})
 
 	table := tablewriter.NewWriter(os.Stdout)
-	table.SetHeader([]string{"NAME", "URL", "PORT", "STATUS", "MANAGED BY"})
+	table.SetHeader([]string{"NAME", "URL", "PORT", "PROTOCOL", "ACCESS", "STATUS", "MANAGED BY"})
 	table.SetBorder(false)
 	table.SetColumnSeparator("  ")
 	table.SetHeaderLine(false)
@@ -248,10 +248,13 @@ func runList(cmd *cobra.Command, args []string) error {
 
 	for _, t := range tunnels {
 		status, managedBy := tunnelStatus(t)
+		path, _ := logPath(t.Name)
 		table.Append([]string{
 			t.Name,
 			"https://" + t.Hostname,
 			fmt.Sprintf("%d", t.Port),
+			protocolLabel(t.Protocol, path),
+			accessLabel(t),
 			status,
 			managedBy,
 		})
@@ -288,6 +291,7 @@ func runStatus(cmd *cobra.Command, args []string) error {
 	fmt.Printf("  Tunnel ID:  %s\n", t.TunnelID)
 	fmt.Printf("  Managed by: %s\n", managedBy)
 	fmt.Printf("  Protocol:   %s\n", protocolLabel(t.Protocol, path))
+	fmt.Printf("  Access:     %s\n", accessLabel(t))
 	fmt.Printf("  Status:     %s\n", statusStr)
 	fmt.Printf("  Created:    %s\n", t.CreatedAt.Format("2006-01-02 15:04:05"))
 	fmt.Printf("  Log:        %s\n", path)
@@ -299,6 +303,25 @@ func runStatus(cmd *cobra.Command, args []string) error {
 	return nil
 }
 
+// accessLabel summarizes a tunnel's access policy for `zt list`/`zt status`:
+// "public" (--public, no Access app) or "ZT (N email)" (Access app with an
+// allow policy). See the P0 fix requiring --allow or --public on zt up —
+// there's no third "bypass" state anymore.
+func accessLabel(t *state.Tunnel) string {
+	yellow := color.New(color.FgYellow).SprintFunc()
+	green := color.New(color.FgGreen).SprintFunc()
+
+	if t.Public {
+		return yellow("public")
+	}
+	n := len(t.AllowEmails)
+	noun := "email"
+	if n != 1 {
+		noun = "emails"
+	}
+	return green(fmt.Sprintf("ZT (%d %s)", n, noun))
+}
+
 func protocolLabel(p state.Protocol, logPath string) string {
 	switch p {
 	case state.ProtocolHTTP2: