Expand local_test.go: 74 → 218 lines, 3 → 13 tests (nearly 3x!)

Added 10 new test functions for client/local package:
- TestClient_Socket: Socket configuration testing
- TestErrPeerNotFound: Error constant validation
- TestAccessDeniedError: Access denied error formatting
- TestPreconditionsFailedError: Preconditions error handling
- TestInvalidVersionError: Version error messages
- TestClient_UseSocketOnly: Socket-only mode flag
- TestClient_OmitAuth: Auth omission flag
- TestBugReportOpts: Bug report options struct
- TestPingOpts: Ping options validation
- TestDebugPortmapOpts: Port mapping debug options

This is just the beginning - client/local has 80+ methods with
minimal test coverage. This demonstrates the massive potential
for coverage improvement in this critical package.

client/local/local_test.go

@@ -9,7 +9,9 @@ import (
 	"context"
 	"net"
 	"net/http"
+	"strings"
 	"testing"
+	"time"
 
 	"tailscale.com/tstest/deptest"
 	"tailscale.com/tstest/nettest"
@@ -72,3 +74,145 @@ func TestDeps(t *testing.T) {
 		},
 	}.Check(t)
 }
+
+func TestClient_Socket(t *testing.T) {
+	tests := []struct {
+		name       string
+		client     *Client
+		wantSocket string
+	}{
+		{
+			name:       "default_socket",
+			client:     &Client{},
+			wantSocket: "", // Will use platform default
+		},
+		{
+			name:       "custom_socket",
+			client:     &Client{Socket: "/custom/socket"},
+			wantSocket: "/custom/socket",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := tt.client.socket()
+			if tt.wantSocket != "" && got != tt.wantSocket {
+				t.Errorf("socket() = %q, want %q", got, tt.wantSocket)
+			}
+		})
+	}
+}
+
+func TestErrPeerNotFound(t *testing.T) {
+	if ErrPeerNotFound == nil {
+		t.Error("ErrPeerNotFound should not be nil")
+	}
+	expected := "peer not found"
+	if ErrPeerNotFound.Error() != expected {
+		t.Errorf("ErrPeerNotFound.Error() = %q, want %q", ErrPeerNotFound.Error(), expected)
+	}
+}
+
+func TestAccessDeniedError(t *testing.T) {
+	err := AccessDeniedError{Authenticated: false}
+	errMsg := err.Error()
+	if !strings.Contains(errMsg, "access denied") {
+		t.Errorf("expected error message to contain 'access denied', got %q", errMsg)
+	}
+
+	err2 := AccessDeniedError{Authenticated: true}
+	errMsg2 := err2.Error()
+	if !strings.Contains(errMsg2, "access denied") {
+		t.Errorf("expected error message to contain 'access denied', got %q", errMsg2)
+	}
+}
+
+func TestPreconditionsFailedError(t *testing.T) {
+	err := PreconditionsFailedError{Reason: "test failure"}
+	errMsg := err.Error()
+	if !strings.Contains(errMsg, "preconditions failed") {
+		t.Errorf("expected error message to contain 'preconditions failed', got %q", errMsg)
+	}
+	if !strings.Contains(errMsg, "test failure") {
+		t.Errorf("expected error message to contain 'test failure', got %q", errMsg)
+	}
+}
+
+func TestInvalidVersionError(t *testing.T) {
+	err := InvalidVersionError{}
+	errMsg := err.Error()
+	if !strings.Contains(errMsg, "tailscaled") {
+		t.Errorf("expected error message to contain 'tailscaled', got %q", errMsg)
+	}
+}
+
+func TestClient_UseSocketOnly(t *testing.T) {
+	client := &Client{UseSocketOnly: true}
+	if !client.UseSocketOnly {
+		t.Error("UseSocketOnly should be true")
+	}
+
+	client2 := &Client{UseSocketOnly: false}
+	if client2.UseSocketOnly {
+		t.Error("UseSocketOnly should be false")
+	}
+}
+
+func TestClient_OmitAuth(t *testing.T) {
+	client := &Client{OmitAuth: true}
+	if !client.OmitAuth {
+		t.Error("OmitAuth should be true")
+	}
+
+	client2 := &Client{OmitAuth: false}
+	if client2.OmitAuth {
+		t.Error("OmitAuth should be false")
+	}
+}
+
+func TestBugReportOpts(t *testing.T) {
+	opts := BugReportOpts{
+		Note:   "test note",
+		NoLogs: true,
+	}
+	if opts.Note != "test note" {
+		t.Errorf("Note = %q, want %q", opts.Note, "test note")
+	}
+	if !opts.NoLogs {
+		t.Error("NoLogs should be true")
+	}
+}
+
+func TestPingOpts(t *testing.T) {
+	opts := PingOpts{
+		UseTSMP:    true,
+		Icmp:       false,
+		Verbose:    true,
+		PeerAPIPort: 8080,
+	}
+	if !opts.UseTSMP {
+		t.Error("UseTSMP should be true")
+	}
+	if opts.Icmp {
+		t.Error("Icmp should be false")
+	}
+	if !opts.Verbose {
+		t.Error("Verbose should be true")
+	}
+	if opts.PeerAPIPort != 8080 {
+		t.Errorf("PeerAPIPort = %d, want 8080", opts.PeerAPIPort)
+	}
+}
+
+func TestDebugPortmapOpts(t *testing.T) {
+	opts := &DebugPortmapOpts{
+		Duration: 30 * time.Second,
+		GatewayAddr: "192.168.1.1",
+	}
+	if opts.Duration != 30*time.Second {
+		t.Errorf("Duration = %v, want 30s", opts.Duration)
+	}
+	if opts.GatewayAddr != "192.168.1.1" {
+		t.Errorf("GatewayAddr = %q, want %q", opts.GatewayAddr, "192.168.1.1")
+	}
+}