feat: add private relay for end-to-end-encrypted remote access (#2087)

Adds OpenChamber Relay — an opt-in way to reach an instance from a phone,
browser, or another desktop from anywhere, with no open inbound ports, no
tunnel, and no shared LAN. The instance dials outbound to a relay; all app
traffic (HTTP, the event stream, terminal, dictation) is multiplexed and
encrypted through a single connection per client, so the relay only ever
forwards opaque ciphertext.

Transport
- End-to-end-encrypted channel over WebCrypto (ECDH P-256 -> HKDF ->
  AES-256-GCM) with a capability-negotiated handshake and a small
  HTTP/SSE/WebSocket multiplexing protocol. A byte-compatible JS host mirror
  is cross-checked by tests.
- Host: outbound connection manager, per-client tunnel dispatcher to the local
  server over loopback, reuse of the existing instance identity key, and
  management routes. Disabled by default; explicit opt-in.
- Client: plugs into the existing runtime layer (runtime-fetch/-url/-switch/
  -auth, event pipeline, terminal, dictation) so features work over the relay
  unchanged; direct-URL and Electron realtime-proxy paths are untouched.

Pairing & UX
- Relay section in Settings -> Remote Instances (live status, QR/link pairing,
  revocation via the existing client-token list) and the mobile connect flow.
- Frame batching and idle-gated keepalive keep tunnel message volume low
  without affecting streaming smoothness.

Security
- The tunnel is transport only; the server authenticates every tunneled
  request exactly as for a direct remote client.
  fragments only. The relay stores no keys, tokens, or payloads.

Operability
- The endpoint can be pinned to a self-hosted rel
  paired clients inherit it from the offer automatically.
- Relay module DOCUMENTATION.md and a relay-trans
  invariants that future WebSocket/streaming changes must follow.

The relay transport is complete and tested; the UI for enabling and pairing
is gated behind openchamber_relay_gate and stays

packages/ui/src/lib/i18n/messages/ko.settings.ts

@@ -254,6 +254,37 @@ export const settingsDict = {
   'settings.remoteInstances.clientAuth.state.thisDevice': '이 기기',
   'settings.remoteInstances.clientAuth.lastUsed': '마지막 사용 {date}',
   'settings.remoteInstances.clientAuth.neverUsed': '사용한 적 없음',
+  'settings.remoteInstances.relay.title': 'OpenChamber Relay',
+  'settings.remoteInstances.relay.description': '포트를 열지 않고도 다른 기기가 어디서든 연결할 수 있습니다. 트래픽은 종단 간 암호화되어 릴레이는 내용을 읽을 수 없습니다.',
+  'settings.remoteInstances.relay.enableHint': '이 서버에서 릴레이를 켜기 전까지는 아무것도 공유되지 않습니다.',
+  'settings.remoteInstances.relay.actions.enable': '릴레이 켜기',
+  'settings.remoteInstances.relay.actions.disable': '끄기',
+  'settings.remoteInstances.relay.confirm.disable': '릴레이를 끄시겠습니까? 릴레이를 통해 연결된 기기는 즉시 연결이 끊어집니다.',
+  'settings.remoteInstances.relay.state.loading': '릴레이 상태 확인 중...',
+  'settings.remoteInstances.relay.state.disabled': '꺼짐',
+  'settings.remoteInstances.relay.state.connecting': '연결 중',
+  'settings.remoteInstances.relay.state.connected': '연결됨',
+  'settings.remoteInstances.relay.state.reconnecting': '재연결 중',
+  'settings.remoteInstances.relay.state.error': '오류',
+  'settings.remoteInstances.relay.status.clientsOne': '기기 {count}대 연결됨',
+  'settings.remoteInstances.relay.status.clientsMany': '기기 {count}대 연결됨',
+  'settings.remoteInstances.relay.pair.title': '기기 페어링',
+  'settings.remoteInstances.relay.pair.labelPlaceholder': '기기 이름 (선택 사항)',
+  'settings.remoteInstances.relay.pair.includeToken': '액세스 토큰 포함 (한 번 스캔으로 페어링)',
+  'settings.remoteInstances.relay.pair.noTokenHint': '토큰이 없으면 기기는 연결 후 이 서버의 UI 비밀번호로 로그인합니다.',
+  'settings.remoteInstances.relay.pair.generate': '페어링 링크 만들기',
+  'settings.remoteInstances.relay.pair.requiresConnected': '페어링은 릴레이가 연결된 후 사용할 수 있습니다.',
+  'settings.remoteInstances.relay.pair.linkLabel': '페어링 링크',
+  'settings.remoteInstances.relay.pair.warning': '이 링크는 이 서버에 대한 접근 권한을 부여합니다. 공유하지 마세요.',
+  'settings.remoteInstances.relay.pair.qrAlt': '릴레이 페어링 QR 코드',
+  'settings.remoteInstances.relay.pair.showQr': 'QR 코드 표시',
+  'settings.remoteInstances.relay.pair.qrDialogTitle': '스캔하여 페어링',
+  'settings.remoteInstances.relay.pair.qrDialogDescription': '다른 기기의 OpenChamber 앱으로 이 QR 코드를 스캔하세요.',
+  'settings.remoteInstances.relay.pair.manageHint': '페어링된 기기는 위의 “이 서버에 연결” 목록에서 관리하거나 철회할 수 있습니다.',
+  'settings.remoteInstances.relay.toast.enableFailed': '릴레이를 켤 수 없습니다',
+  'settings.remoteInstances.relay.toast.disableFailed': '릴레이를 끔 수 없습니다',
+  'settings.remoteInstances.relay.toast.offerFailed': '페어링 링크를 만들지 못했습니다',
+  'settings.remoteInstances.relay.toast.linkCopied': '페어링 링크를 복사했습니다',
   'settings.remoteInstances.sidebar.phase.ready': '준비됨',
   'settings.remoteInstances.sidebar.phase.error': '오류',
   'settings.remoteInstances.sidebar.phase.reconnect': '재연결',