feat: add private relay for end-to-end-encrypted remote access (#2087)

Adds OpenChamber Relay — an opt-in way to reach an instance from a phone,
browser, or another desktop from anywhere, with no open inbound ports, no
tunnel, and no shared LAN. The instance dials outbound to a relay; all app
traffic (HTTP, the event stream, terminal, dictation) is multiplexed and
encrypted through a single connection per client, so the relay only ever
forwards opaque ciphertext.

Transport
- End-to-end-encrypted channel over WebCrypto (ECDH P-256 -> HKDF ->
  AES-256-GCM) with a capability-negotiated handshake and a small
  HTTP/SSE/WebSocket multiplexing protocol. A byte-compatible JS host mirror
  is cross-checked by tests.
- Host: outbound connection manager, per-client tunnel dispatcher to the local
  server over loopback, reuse of the existing instance identity key, and
  management routes. Disabled by default; explicit opt-in.
- Client: plugs into the existing runtime layer (runtime-fetch/-url/-switch/
  -auth, event pipeline, terminal, dictation) so features work over the relay
  unchanged; direct-URL and Electron realtime-proxy paths are untouched.

Pairing & UX
- Relay section in Settings -> Remote Instances (live status, QR/link pairing,
  revocation via the existing client-token list) and the mobile connect flow.
- Frame batching and idle-gated keepalive keep tunnel message volume low
  without affecting streaming smoothness.

Security
- The tunnel is transport only; the server authenticates every tunneled
  request exactly as for a direct remote client.
  fragments only. The relay stores no keys, tokens, or payloads.

Operability
- The endpoint can be pinned to a self-hosted rel
  paired clients inherit it from the offer automatically.
- Relay module DOCUMENTATION.md and a relay-trans
  invariants that future WebSocket/streaming changes must follow.

The relay transport is complete and tested; the UI for enabling and pairing
is gated behind openchamber_relay_gate and stays

packages/ui/src/lib/terminalApi.ts

@@ -1,5 +1,7 @@
 import { getRuntimeUrlResolver } from './runtime-url';
 import { runtimeFetch } from './runtime-fetch';
+import { openRuntimeWebSocket } from './relay/runtime-socket';
+import { type RelayTunnelWebSocket } from './relay/tunnel-client';
 
 interface TerminalWebSocketDescriptor {
   path: string;
@@ -132,11 +134,11 @@ const createTransportError = (code: string | undefined): Error => {
 };
 
 class TerminalTransportManager {
-  private socket: WebSocket | null = null;
+  private socket: RelayTunnelWebSocket | null = null;
   private socketUrl = '';
   private boundSessionId: string | null = null;
   private requestedSessionId: string | null = null;
-  private openPromise: Promise<WebSocket | null> | null = null;
+  private openPromise: Promise<RelayTunnelWebSocket | null> | null = null;
   private reconnectTimeout: ReturnType<typeof setTimeout> | null = null;
   private keepaliveInterval: ReturnType<typeof setInterval> | null = null;
   private closed = false;
@@ -311,7 +313,7 @@ class TerminalTransportManager {
     subscription.connectionTimeoutId = null;
   }
 
-  private async getOpenSocket(waitMs: number): Promise<WebSocket | null> {
+  private async getOpenSocket(waitMs: number): Promise<RelayTunnelWebSocket | null> {
     if (this.socket && this.socket.readyState === WS_READY_STATE_OPEN) {
       return this.socket;
     }
@@ -355,11 +357,11 @@ class TerminalTransportManager {
 
     this.clearReconnectTimeout();
 
-    this.openPromise = new Promise<WebSocket | null>((resolve) => {
+    this.openPromise = new Promise<RelayTunnelWebSocket | null>((resolve) => {
       let settled = false;
       let connectTimeout: ReturnType<typeof setTimeout> | null = null;
 
-      const settle = (value: WebSocket | null) => {
+      const settle = (value: RelayTunnelWebSocket | null) => {
         if (settled) {
           return;
         }
@@ -373,7 +375,7 @@ class TerminalTransportManager {
       };
 
       try {
-        const socket = new WebSocket(this.socketUrl);
+        const socket = openRuntimeWebSocket(this.socketUrl);
         socket.binaryType = 'arraybuffer';
 
         socket.onopen = () => {