feat: add private relay for end-to-end-encrypted remote access (#2087)

Adds OpenChamber Relay — an opt-in way to reach an instance from a phone,
browser, or another desktop from anywhere, with no open inbound ports, no
tunnel, and no shared LAN. The instance dials outbound to a relay; all app
traffic (HTTP, the event stream, terminal, dictation) is multiplexed and
encrypted through a single connection per client, so the relay only ever
forwards opaque ciphertext.

Transport
- End-to-end-encrypted channel over WebCrypto (ECDH P-256 -> HKDF ->
  AES-256-GCM) with a capability-negotiated handshake and a small
  HTTP/SSE/WebSocket multiplexing protocol. A byte-compatible JS host mirror
  is cross-checked by tests.
- Host: outbound connection manager, per-client tunnel dispatcher to the local
  server over loopback, reuse of the existing instance identity key, and
  management routes. Disabled by default; explicit opt-in.
- Client: plugs into the existing runtime layer (runtime-fetch/-url/-switch/
  -auth, event pipeline, terminal, dictation) so features work over the relay
  unchanged; direct-URL and Electron realtime-proxy paths are untouched.

Pairing & UX
- Relay section in Settings -> Remote Instances (live status, QR/link pairing,
  revocation via the existing client-token list) and the mobile connect flow.
- Frame batching and idle-gated keepalive keep tunnel message volume low
  without affecting streaming smoothness.

Security
- The tunnel is transport only; the server authenticates every tunneled
  request exactly as for a direct remote client.
  fragments only. The relay stores no keys, tokens, or payloads.

Operability
- The endpoint can be pinned to a self-hosted rel
  paired clients inherit it from the offer automatically.
- Relay module DOCUMENTATION.md and a relay-trans
  invariants that future WebSocket/streaming changes must follow.

The relay transport is complete and tested; the UI for enabling and pairing
is gated behind openchamber_relay_gate and stays

packages/web/server/lib/notifications/apns-runtime.js

@@ -9,6 +9,11 @@
 // Wired into the same trigger fanout as web push (see runtime.js); the relay carries only
 // generic, model-based text (no session content) — see APNS.md.
 
+import {
+  getOrCreateRelaySigningKeypair,
+  signRelayMessage as signRelayMessageShared,
+} from '../relay/signing-key.js';
+
 const APNS_TOKENS_VERSION = 1;
 const APNS_HOST_PRODUCTION = 'https://api.push.apple.com';
 const APNS_HOST_SANDBOX = 'https://api.sandbox.push.apple.com';
@@ -51,27 +56,15 @@ export const createApnsRuntime = (deps) => {
   // device token alone can't be used to push. Zero-config: the keypair generates on first use.
   // ---------------------------------------------------------------------------
 
+  // Key access lives in lib/relay/signing-key.js now (shared with the private
+  // relay identity — same keypair, same storage, same serverId derivation).
   const getOrCreateRelayKeypair = async () => {
     if (cachedRelayKey) return cachedRelayKey;
-    const settings = await readSettingsFromDiskMigrated();
-    const existing = settings?.relaySigningKey;
-    if (existing && existing.privateJwk && existing.publicJwk) {
-      cachedRelayKey = {
-        privateKey: crypto.createPrivateKey({ key: existing.privateJwk, format: 'jwk' }),
-        publicJwk: existing.publicJwk,
-      };
-      return cachedRelayKey;
-    }
-    const { privateKey, publicKey } = crypto.generateKeyPairSync('ec', { namedCurve: 'P-256' });
-    const privateJwk = privateKey.export({ format: 'jwk' });
-    const publicJwk = publicKey.export({ format: 'jwk' });
-    await writeSettingsToDisk({ ...settings, relaySigningKey: { privateJwk, publicJwk } });
-    cachedRelayKey = { privateKey, publicJwk };
+    cachedRelayKey = await getOrCreateRelaySigningKeypair({ crypto, readSettingsFromDiskMigrated, writeSettingsToDisk });
     return cachedRelayKey;
   };
 
-  const signRelayMessage = (privateKey, message) =>
-    crypto.sign('SHA256', Buffer.from(message), { key: privateKey, dsaEncoding: 'ieee-p1363' }).toString('base64url');
+  const signRelayMessage = (privateKey, message) => signRelayMessageShared({ crypto }, privateKey, message);
 
   // Trim to the 4 fields the relay's schema accepts (and that feed the serverId hash).
   const relayPublicJwk = (publicJwk) => ({