Acceptance bar honored by honesty: the doc leads with what cannot work (no tunnel carries inbound UDP -> WebRTC unreachable behind CGNAT). Three tiers: ngrok blessed dev path with the free-tier arithmetic (~140 MB/ call-hour -> ~7 call-hours/month), Tailscale Funnel single-user demo (ciphertext-only), and the VPS+WireGuard graduation with TLS terminating at home (forwarder physically cannot read audio; media UDP DNAT restores WebRTC). cloudflared explicitly excluded even for dev (#1465, #1282). Signed-off-by: Aaron D. Lee <himself@adlee.work>