feat(relay): rendezvous-relay service — 7 packages + plans (contracts/transport/agent/control-plane/e2e/auth/web)

Multi-tenant reverse-tunnel service ("ngrok for Claude Code" with E2E): a
host-agent dials OUT to an operator-run relay; external devices reach the host
THROUGH the relay, routed by per-tenant subdomain, forwarding ciphertext only
(the relay never sees plaintext). Lets a customer reach their own self-hosted
web-terminal from anywhere with zero networking setup.

Packages — all tsc-strict + vitest green (656 tests), cross-package integration verified:
- relay-contracts: frozen shared contracts (mux frame codec, data model,
  capability token, E2E envelope, pairing) — the src/types.ts analog
- term-relay:   native WS mux + stateless data plane (subdomain routing, ciphertext forward)
- agent:        host-agent (pairing, per-host Ed25519 + mTLS dial-out, forwards to 127.0.0.1:3000)
- control-plane: accounts/hosts registry, pairing-code flow, routing table, provisioning
- relay-e2e:    browser<->agent E2E (X25519 ECDH through relay, AEAD, anti-replay, recoverable replay key)
- relay-auth:   Passkey/WebAuthn, capability tokens, per-host certs, deny-by-default tenant isolation
- relay-web:    browser login + Web Crypto E2E + client-side preview rendering

Security invariants INV1-15 enforced; cross-tenant isolation CI tripwire live
(.github/workflows/relay-tripwire.yml). Design + implementation-level plans in
docs/PLAN_RELAY_*.md and docs/EXPLORE_RELAY_SERVICE.md.

NOTE: generated autonomously per the reviewed plans. The security-critical
packages (relay-e2e, relay-auth) REQUIRE expert security audit before any real
deployment — passing tests prove self-consistency, not resistance to attackers.
Base app (src/, public/) unchanged; concurrent desktop work left uncommitted.

control-plane/src/node-auth/identity.ts

@@ -0,0 +1,56 @@
+/**
+ * T9 — relay-node ↔ control-plane trust boundary (the node analog of INV3). `nodeId` is derived
+ * from the VERIFIED relay-node mTLS client-cert subject — NEVER from a body/query/header field.
+ * A request that carries a `nodeId` payload has it IGNORED for identity. Non-mutually-authenticated
+ * connections throw 401.
+ *
+ * OQ5 (open): who ISSUES/ROTATES the node service certs + the SVID format the CP pins
+ * (`nodeMtlsTrustBundlePath`) is a P5/P1 boundary. Here we consume an already-verified peer cert.
+ */
+export interface NodeIdentity {
+  readonly nodeId: string
+}
+
+export class NodeAuthError extends Error {
+  readonly status = 401
+  constructor(message: string) {
+    super(message)
+  }
+}
+
+/** The shape we need from a verified TLS peer certificate (subset of Node's PeerCertificate). */
+export interface VerifiedPeerCert {
+  readonly authorized: boolean // TLS stack verified the client cert against the trust bundle
+  readonly subjectCommonName: string | null // SPIFFE-style node id in the cert subject CN / SAN URI
+}
+
+/** Pure derivation — the request wrapper below feeds it the extracted peer cert. */
+export function deriveNodeIdentity(cert: VerifiedPeerCert | null): NodeIdentity {
+  if (cert === null || !cert.authorized) {
+    throw new NodeAuthError('relay-node connection is not mutually authenticated')
+  }
+  const cn = cert.subjectCommonName
+  if (cn === null || cn.trim() === '') {
+    throw new NodeAuthError('relay-node client cert has no subject identity')
+  }
+  return { nodeId: cn }
+}
+
+/** Minimal request shape carrying a TLS socket (Fastify/Node). */
+export interface RequestWithTls {
+  readonly socket: {
+    authorized?: boolean
+    getPeerCertificate?: () => { subject?: { CN?: string } } | undefined
+  }
+}
+
+/**
+ * Extract the verified node identity from a live request's TLS session. INTEGRATION SEAM: the
+ * exact SAN/URI SVID parsing is finalized with OQ5; here we read authorized + subject CN.
+ */
+export function nodeIdentityFromRequest(req: RequestWithTls): NodeIdentity {
+  const authorized = req.socket.authorized === true
+  const peer = req.socket.getPeerCertificate?.()
+  const cn = peer?.subject?.CN ?? null
+  return deriveNodeIdentity({ authorized, subjectCommonName: cn })
+}