feat: add private relay for end-to-end-encrypted remote access (#2087)

Adds OpenChamber Relay — an opt-in way to reach an instance from a phone,
browser, or another desktop from anywhere, with no open inbound ports, no
tunnel, and no shared LAN. The instance dials outbound to a relay; all app
traffic (HTTP, the event stream, terminal, dictation) is multiplexed and
encrypted through a single connection per client, so the relay only ever
forwards opaque ciphertext.

Transport
- End-to-end-encrypted channel over WebCrypto (ECDH P-256 -> HKDF ->
  AES-256-GCM) with a capability-negotiated handshake and a small
  HTTP/SSE/WebSocket multiplexing protocol. A byte-compatible JS host mirror
  is cross-checked by tests.
- Host: outbound connection manager, per-client tunnel dispatcher to the local
  server over loopback, reuse of the existing instance identity key, and
  management routes. Disabled by default; explicit opt-in.
- Client: plugs into the existing runtime layer (runtime-fetch/-url/-switch/
  -auth, event pipeline, terminal, dictation) so features work over the relay
  unchanged; direct-URL and Electron realtime-proxy paths are untouched.

Pairing & UX
- Relay section in Settings -> Remote Instances (live status, QR/link pairing,
  revocation via the existing client-token list) and the mobile connect flow.
- Frame batching and idle-gated keepalive keep tunnel message volume low
  without affecting streaming smoothness.

Security
- The tunnel is transport only; the server authenticates every tunneled
  request exactly as for a direct remote client.
  fragments only. The relay stores no keys, tokens, or payloads.

Operability
- The endpoint can be pinned to a self-hosted rel
  paired clients inherit it from the offer automatically.
- Relay module DOCUMENTATION.md and a relay-trans
  invariants that future WebSocket/streaming changes must follow.

The relay transport is complete and tested; the UI for enabling and pairing
is gated behind openchamber_relay_gate and stays

packages/ui/src/lib/i18n/messages/zh-TW.settings.ts

@@ -260,6 +260,37 @@
   'settings.remoteInstances.clientAuth.state.thisDevice': '此裝置',
   'settings.remoteInstances.clientAuth.lastUsed': '上次使用：{date}',
   'settings.remoteInstances.clientAuth.neverUsed': '從未使用',
+  'settings.remoteInstances.relay.title': 'OpenChamber Relay',
+  'settings.remoteInstances.relay.description': '無需開放連接埠，即可讓你的其他裝置從任何地方連線。流量端對端加密，中繼無法讀取內容。',
+  'settings.remoteInstances.relay.enableHint': '在此伺服器上啟用中繼之前，不會共享任何內容。',
+  'settings.remoteInstances.relay.actions.enable': '啟用中繼',
+  'settings.remoteInstances.relay.actions.disable': '停用',
+  'settings.remoteInstances.relay.confirm.disable': '停用中繼？透過它連線的裝置將立即中斷連線。',
+  'settings.remoteInstances.relay.state.loading': '正在檢查中繼狀態...',
+  'settings.remoteInstances.relay.state.disabled': '已停用',
+  'settings.remoteInstances.relay.state.connecting': '連線中',
+  'settings.remoteInstances.relay.state.connected': '已連線',
+  'settings.remoteInstances.relay.state.reconnecting': '重新連線中',
+  'settings.remoteInstances.relay.state.error': '錯誤',
+  'settings.remoteInstances.relay.status.clientsOne': '已連線 {count} 台裝置',
+  'settings.remoteInstances.relay.status.clientsMany': '已連線 {count} 台裝置',
+  'settings.remoteInstances.relay.pair.title': '配對裝置',
+  'settings.remoteInstances.relay.pair.labelPlaceholder': '裝置名稱（選填）',
+  'settings.remoteInstances.relay.pair.includeToken': '包含存取權杖（掃一次即完成配對）',
+  'settings.remoteInstances.relay.pair.noTokenHint': '不包含權杖時，裝置連線後需使用此伺服器的介面密碼登入。',
+  'settings.remoteInstances.relay.pair.generate': '建立配對連結',
+  'settings.remoteInstances.relay.pair.requiresConnected': '中繼連線後即可配對。',
+  'settings.remoteInstances.relay.pair.linkLabel': '配對連結',
+  'settings.remoteInstances.relay.pair.warning': '此連結可存取此伺服器，請勿分享。',
+  'settings.remoteInstances.relay.pair.qrAlt': '中繼配對 QR 碼',
+  'settings.remoteInstances.relay.pair.showQr': '顯示 QR 碼',
+  'settings.remoteInstances.relay.pair.qrDialogTitle': '掃描配對',
+  'settings.remoteInstances.relay.pair.qrDialogDescription': '用另一台裝置上的 OpenChamber 應用程式掃描此 QR 碼。',
+  'settings.remoteInstances.relay.pair.manageHint': '可在上方「連線到此伺服器」清單中管理或撤銷已配對的裝置。',
+  'settings.remoteInstances.relay.toast.enableFailed': '無法啟用中繼',
+  'settings.remoteInstances.relay.toast.disableFailed': '無法停用中繼',
+  'settings.remoteInstances.relay.toast.offerFailed': '無法建立配對連結',
+  'settings.remoteInstances.relay.toast.linkCopied': '已複製配對連結',
   'settings.remoteInstances.page.section.instance': '執行個體',
   'settings.remoteInstances.page.section.instanceDescription': '核心 SSH 設定。',
   'settings.remoteInstances.page.field.mode': '模式',