feat: add private relay for end-to-end-encrypted remote access (#2087)

Adds OpenChamber Relay — an opt-in way to reach an instance from a phone,
browser, or another desktop from anywhere, with no open inbound ports, no
tunnel, and no shared LAN. The instance dials outbound to a relay; all app
traffic (HTTP, the event stream, terminal, dictation) is multiplexed and
encrypted through a single connection per client, so the relay only ever
forwards opaque ciphertext.

Transport
- End-to-end-encrypted channel over WebCrypto (ECDH P-256 -> HKDF ->
  AES-256-GCM) with a capability-negotiated handshake and a small
  HTTP/SSE/WebSocket multiplexing protocol. A byte-compatible JS host mirror
  is cross-checked by tests.
- Host: outbound connection manager, per-client tunnel dispatcher to the local
  server over loopback, reuse of the existing instance identity key, and
  management routes. Disabled by default; explicit opt-in.
- Client: plugs into the existing runtime layer (runtime-fetch/-url/-switch/
  -auth, event pipeline, terminal, dictation) so features work over the relay
  unchanged; direct-URL and Electron realtime-proxy paths are untouched.

Pairing & UX
- Relay section in Settings -> Remote Instances (live status, QR/link pairing,
  revocation via the existing client-token list) and the mobile connect flow.
- Frame batching and idle-gated keepalive keep tunnel message volume low
  without affecting streaming smoothness.

Security
- The tunnel is transport only; the server authenticates every tunneled
  request exactly as for a direct remote client.
  fragments only. The relay stores no keys, tokens, or payloads.

Operability
- The endpoint can be pinned to a self-hosted rel
  paired clients inherit it from the offer automatically.
- Relay module DOCUMENTATION.md and a relay-trans
  invariants that future WebSocket/streaming changes must follow.

The relay transport is complete and tested; the UI for enabling and pairing
is gated behind openchamber_relay_gate and stays

packages/web/bin/lib/cli-args.js

@@ -264,6 +264,9 @@ function parseArgs(argv = process.argv.slice(2)) {
         }
         break;
       }
+      case 'relay':
+        options.relay = true;
+        break;
       case 'qr':
         options.qr = true;
         options.explicitQr = true;
@@ -384,6 +387,7 @@ OPTIONS:
   --hostname              Alias for --host outside tunnel commands
   --lan                   Bind to 0.0.0.0 for LAN access
   --server <url>          Public/server URL for connect-url links
+  --relay                 connect-url: generate an end-to-end-encrypted relay pairing link
   --ui-password           Protect browser UI with single password
   --api-only              Start API routes only, without serving browser UI assets
   --foreground            Run server in foreground (use with systemd/process managers)
@@ -461,6 +465,10 @@ OPTIONS:
   --lan                   Bind to 0.0.0.0 for LAN access when starting
   --server <url>          Public URL saved into the connection link
   --server-url <url>      Alias for --server
+  --relay                 Generate an end-to-end-encrypted relay pairing link
+                          (no server URL needed; requires the relay enabled on
+                          this instance). Set OPENCHAMBER_RELAY_URL to use a
+                          self-hosted relay.
   --name <label>          Label saved with the remote client token
   --ui-password <value>   Protect browser access when UI routes are enabled
   --api-only              Start in headless/API-only mode when starting
@@ -473,6 +481,7 @@ EXAMPLES:
   openchamber connect-url --port 3000 --qr
   openchamber connect-url --port 3000 --api-only --lan --server http://workstation.local:3000 --qr
   openchamber connect-url --server https://openchamber.example.com --name Workstation
+  openchamber connect-url --relay --name "My laptop"
 `);
 }