feat: add private relay for end-to-end-encrypted remote access (#2087)

Adds OpenChamber Relay — an opt-in way to reach an instance from a phone,
browser, or another desktop from anywhere, with no open inbound ports, no
tunnel, and no shared LAN. The instance dials outbound to a relay; all app
traffic (HTTP, the event stream, terminal, dictation) is multiplexed and
encrypted through a single connection per client, so the relay only ever
forwards opaque ciphertext.

Transport
- End-to-end-encrypted channel over WebCrypto (ECDH P-256 -> HKDF ->
  AES-256-GCM) with a capability-negotiated handshake and a small
  HTTP/SSE/WebSocket multiplexing protocol. A byte-compatible JS host mirror
  is cross-checked by tests.
- Host: outbound connection manager, per-client tunnel dispatcher to the local
  server over loopback, reuse of the existing instance identity key, and
  management routes. Disabled by default; explicit opt-in.
- Client: plugs into the existing runtime layer (runtime-fetch/-url/-switch/
  -auth, event pipeline, terminal, dictation) so features work over the relay
  unchanged; direct-URL and Electron realtime-proxy paths are untouched.

Pairing & UX
- Relay section in Settings -> Remote Instances (live status, QR/link pairing,
  revocation via the existing client-token list) and the mobile connect flow.
- Frame batching and idle-gated keepalive keep tunnel message volume low
  without affecting streaming smoothness.

Security
- The tunnel is transport only; the server authenticates every tunneled
  request exactly as for a direct remote client.
  fragments only. The relay stores no keys, tokens, or payloads.

Operability
- The endpoint can be pinned to a self-hosted rel
  paired clients inherit it from the offer automatically.
- Relay module DOCUMENTATION.md and a relay-trans
  invariants that future WebSocket/streaming changes must follow.

The relay transport is complete and tested; the UI for enabling and pairing
is gated behind openchamber_relay_gate and stays

packages/web/server/lib/relay/identity.js

@@ -0,0 +1,73 @@
+// Host relay identity: the EXISTING ECDSA P-256 signing keypair (shared with
+// the push relay via signing-key.js — same storage, same serverId) plus a NEW
+// long-lived ECDH P-256 encryption keypair for the E2EE channel (WebCrypto
+// keys are single-purpose, so signing and encryption keys must differ).
+// The encryption keypair is persisted as `settings.relayEncryptionKey =
+// { privateJwk, publicJwk }`, mirroring the relaySigningKey precedent.
+
+import {
+  canonicalPublicJwkString,
+  deriveServerId,
+  getOrCreateRelaySigningKeypair,
+  signRelayMessage,
+} from './signing-key.js';
+import { exportPublicKeyJwk, generateEcdhKeyPair, importEcdhPrivateKey } from './e2ee.js';
+
+const isJwkPair = (value) => Boolean(value && typeof value === 'object' && value.privateJwk && value.publicJwk);
+
+/**
+ * @param {{ crypto: typeof import('node:crypto'), readSettingsFromDiskMigrated: () => Promise<object>, writeSettingsToDisk: (settings: object) => Promise<void> }} deps
+ */
+export const createRelayIdentityRuntime = (deps) => {
+  const { crypto, readSettingsFromDiskMigrated, writeSettingsToDisk } = deps;
+
+  let cachedIdentity = null;
+
+  const getOrCreateEncryptionKeypair = async () => {
+    const settings = await readSettingsFromDiskMigrated();
+    const existing = settings?.relayEncryptionKey;
+    if (isJwkPair(existing)) {
+      return existing;
+    }
+    const keyPair = await generateEcdhKeyPair();
+    const privateJwk = await globalThis.crypto.subtle.exportKey('jwk', keyPair.privateKey);
+    const publicJwk = await exportPublicKeyJwk(keyPair.publicKey);
+    await writeSettingsToDisk({ ...settings, relayEncryptionKey: { privateJwk, publicJwk } });
+    return { privateJwk, publicJwk };
+  };
+
+  /**
+   * @returns {Promise<{
+   *   serverId: string,
+   *   hostEncPubJwk: JsonWebKey,
+   *   hostEncPrivateKey: CryptoKey,
+   *   signRelayAuth: (role: string, connectionId?: string | null) => { ts: number, sig: string, pk: string },
+   * }>}
+   */
+  const getRelayIdentity = async () => {
+    if (cachedIdentity) return cachedIdentity;
+    const signing = await getOrCreateRelaySigningKeypair({ crypto, readSettingsFromDiskMigrated, writeSettingsToDisk });
+    const serverId = deriveServerId({ crypto }, signing.publicJwk);
+    const encryption = await getOrCreateEncryptionKeypair();
+    const hostEncPrivateKey = await importEcdhPrivateKey(encryption.privateJwk);
+    const pk = Buffer.from(canonicalPublicJwkString(signing.publicJwk), 'utf8').toString('base64url');
+
+    // Relay-layer auth for host-control / host-data upgrades. Signature payload
+    // string is `${ts}.${serverId}.${role}.${connectionId ?? ""}` (spec Layer 1).
+    const signRelayAuth = (role, connectionId) => {
+      const ts = Date.now();
+      const sig = signRelayMessage({ crypto }, signing.privateKey, `${ts}.${serverId}.${role}.${connectionId ?? ''}`);
+      return { ts, sig, pk };
+    };
+
+    cachedIdentity = {
+      serverId,
+      hostEncPubJwk: encryption.publicJwk,
+      hostEncPrivateKey,
+      signRelayAuth,
+    };
+    return cachedIdentity;
+  };
+
+  return { getRelayIdentity };
+};