feat: add private relay for end-to-end-encrypted remote access (#2087)

Adds OpenChamber Relay — an opt-in way to reach an instance from a phone,
browser, or another desktop from anywhere, with no open inbound ports, no
tunnel, and no shared LAN. The instance dials outbound to a relay; all app
traffic (HTTP, the event stream, terminal, dictation) is multiplexed and
encrypted through a single connection per client, so the relay only ever
forwards opaque ciphertext.

Transport
- End-to-end-encrypted channel over WebCrypto (ECDH P-256 -> HKDF ->
  AES-256-GCM) with a capability-negotiated handshake and a small
  HTTP/SSE/WebSocket multiplexing protocol. A byte-compatible JS host mirror
  is cross-checked by tests.
- Host: outbound connection manager, per-client tunnel dispatcher to the local
  server over loopback, reuse of the existing instance identity key, and
  management routes. Disabled by default; explicit opt-in.
- Client: plugs into the existing runtime layer (runtime-fetch/-url/-switch/
  -auth, event pipeline, terminal, dictation) so features work over the relay
  unchanged; direct-URL and Electron realtime-proxy paths are untouched.

Pairing & UX
- Relay section in Settings -> Remote Instances (live status, QR/link pairing,
  revocation via the existing client-token list) and the mobile connect flow.
- Frame batching and idle-gated keepalive keep tunnel message volume low
  without affecting streaming smoothness.

Security
- The tunnel is transport only; the server authenticates every tunneled
  request exactly as for a direct remote client.
  fragments only. The relay stores no keys, tokens, or payloads.

Operability
- The endpoint can be pinned to a self-hosted rel
  paired clients inherit it from the offer automatically.
- Relay module DOCUMENTATION.md and a relay-trans
  invariants that future WebSocket/streaming changes must follow.

The relay transport is complete and tested; the UI for enabling and pairing
is gated behind openchamber_relay_gate and stays

packages/ui/src/lib/relay/runtime-tunnel.ts

@@ -0,0 +1,47 @@
+// Module-level singleton holding the active relay tunnel client, if the runtime
+// is in relay mode. Kept in its own module so runtime-switch, runtime-fetch,
+// runtime-url, and the event pipeline can all read it without an import cycle
+// (runtime-switch <-> runtime-url).
+
+import { createRelayTunnelClient, type RelayTunnelClient } from './tunnel-client';
+
+export interface RelayRuntimeDescriptor {
+  relayUrl: string;
+  serverId: string;
+  hostEncPubJwk: JsonWebKey;
+  grant?: string;
+}
+
+let activeTunnel: RelayTunnelClient | null = null;
+let activeDescriptor: RelayRuntimeDescriptor | null = null;
+
+const descriptorsEqual = (a: RelayRuntimeDescriptor, b: RelayRuntimeDescriptor): boolean =>
+  a.relayUrl === b.relayUrl &&
+  a.serverId === b.serverId &&
+  a.grant === b.grant &&
+  JSON.stringify(a.hostEncPubJwk) === JSON.stringify(b.hostEncPubJwk);
+
+export const getActiveRelayTunnel = (): RelayTunnelClient | null => activeTunnel;
+
+export const isRelayModeActive = (): boolean => activeTunnel !== null;
+
+/**
+ * Activates relay mode with the given descriptor, replacing any previous tunnel.
+ * Reuses the existing client when the descriptor is unchanged so a redundant
+ * runtime switch does not tear down a live tunnel.
+ */
+export const activateRelayTunnel = (descriptor: RelayRuntimeDescriptor): RelayTunnelClient => {
+  if (activeTunnel && activeDescriptor && descriptorsEqual(activeDescriptor, descriptor)) {
+    return activeTunnel;
+  }
+  activeTunnel?.close();
+  activeDescriptor = descriptor;
+  activeTunnel = createRelayTunnelClient(descriptor);
+  return activeTunnel;
+};
+
+export const deactivateRelayTunnel = (): void => {
+  activeTunnel?.close();
+  activeTunnel = null;
+  activeDescriptor = null;
+};