Summary

Document the operational check that matters for the Schwab home-exit proxy: when a VPS or tunnel is used as the public endpoint, the final upstream must still exit through the intended home/router WAN address.

Background

The refresher can successfully reach a public proxy while still failing Schwab login if that proxy ultimately egresses through a VPS, VPN, or WireGuard route instead of the residential/router path. That failure can look like an invalid credential page even when the stored Schwab credentials are unchanged.

Changes

• Add README guidance for VPS/tunnel proxy topologies.
• Add a safe curl --proxy probe against Schwab's authorize endpoint.
• Clarify that an OAuth/client error from the bare authorize URL is acceptable, while tunnel failures or wrong final exit IP should be fixed before changing secrets.

Validation

• node --check main.js
• node tests/test_auth_code_extraction.js
• node tests/test_proxy_config.js
• bash tests/test_workflow_config_sources.sh
• git diff --check
• Manual workflow verification after fixing the router/VPS upstream path: run 25230603601 succeeded and synced token version 15.