feat(relay): rendezvous-relay service — 7 packages + plans (contracts/transport/agent/control-plane/e2e/auth/web)

Multi-tenant reverse-tunnel service ("ngrok for Claude Code" with E2E): a
host-agent dials OUT to an operator-run relay; external devices reach the host
THROUGH the relay, routed by per-tenant subdomain, forwarding ciphertext only
(the relay never sees plaintext). Lets a customer reach their own self-hosted
web-terminal from anywhere with zero networking setup.

Packages — all tsc-strict + vitest green (656 tests), cross-package integration verified:
- relay-contracts: frozen shared contracts (mux frame codec, data model,
  capability token, E2E envelope, pairing) — the src/types.ts analog
- term-relay:   native WS mux + stateless data plane (subdomain routing, ciphertext forward)
- agent:        host-agent (pairing, per-host Ed25519 + mTLS dial-out, forwards to 127.0.0.1:3000)
- control-plane: accounts/hosts registry, pairing-code flow, routing table, provisioning
- relay-e2e:    browser<->agent E2E (X25519 ECDH through relay, AEAD, anti-replay, recoverable replay key)
- relay-auth:   Passkey/WebAuthn, capability tokens, per-host certs, deny-by-default tenant isolation
- relay-web:    browser login + Web Crypto E2E + client-side preview rendering

Security invariants INV1-15 enforced; cross-tenant isolation CI tripwire live
(.github/workflows/relay-tripwire.yml). Design + implementation-level plans in
docs/PLAN_RELAY_*.md and docs/EXPLORE_RELAY_SERVICE.md.

NOTE: generated autonomously per the reviewed plans. The security-critical
packages (relay-e2e, relay-auth) REQUIRE expert security audit before any real
deployment — passing tests prove self-consistency, not resistance to attackers.
Base app (src/, public/) unchanged; concurrent desktop work left uncommitted.

relay-auth/src/index.ts

@@ -0,0 +1,104 @@
+/**
+ * relay-auth (P5) public barrel — the authorization surface P1/P3/P6 import. Imports
+ * relay-contracts (§4) read-only; never redefines a frozen contract. Socket-free (no ws/xterm/ANSI
+ * parser → INV2/INV11 hold by construction).
+ */
+export * from './types.js'
+
+// Config (INV9)
+export {
+  configureVerifyKey,
+  loadVerifyKeyFromEnv,
+  getVerifyKey,
+  KeyConfigError,
+} from './config/keys.js'
+
+// T2 capability tokens + DPoP + device-auth proof
+export { issueCapabilityToken, CONNECT_TOKEN_MIN_TTL_SEC, CONNECT_TOKEN_MAX_TTL_SEC } from './capability/issue.js'
+export {
+  verifyCapabilityToken,
+  verifyDpopProof,
+  readCnfJkt,
+  subAccountId,
+  hasRight,
+  peekExp,
+  type DpopContext,
+} from './capability/verify.js'
+export { CapabilityError } from './capability/errors.js'
+export {
+  signDeviceAuthProof,
+  verifyDeviceProof,
+  deviceProofAccount,
+  type DeviceProofBinding,
+} from './capability/device-proof.js'
+
+// T3 authz
+export {
+  authorizeConnect,
+  authorizeReattach,
+  type AuthzOutcome,
+  type ConnectRequest,
+  type ReattachRequest,
+} from './authz/decide.js'
+export { accountIdFromToken, principalFromToken, AuthzInputError } from './authz/principal.js'
+
+// T4 audit
+export { buildAuditEvent, audit } from './audit/log.js'
+export { assertZeroPayload, ZeroPayloadViolation, MAX_METADATA_LEN } from './audit/redact.js'
+export { onAuditEvent, type Alerter, type AlertKind } from './audit/alert.js'
+
+// T5–T8 human auth
+export { startRegistration, finishRegistration } from './human/webauthn/register.js'
+export { startAuthentication, finishAuthentication } from './human/webauthn/authenticate.js'
+export * from './human/webauthn/verifier.js'
+export {
+  generateTotpSecret,
+  verifyTotp,
+  checkTotpAttemptRate,
+  recordTotpFailure,
+} from './human/totp/totp.js'
+export {
+  buildAuthUrl,
+  exchangeCode,
+  verifyIdToken,
+  randomUrlToken,
+  pkceChallenge,
+  OidcError,
+  type OidcConfig,
+  type OidcTokenSet,
+} from './human/oidc/oidc.js'
+export {
+  policyForHost,
+  needsStepUp,
+  recordStepUp,
+  DEFAULT_STEPUP_MAX_AGE_SECONDS,
+} from './human/stepup/stepup.js'
+
+// T9 mTLS / SPIFFE
+export { spiffeIdFor, parseSpiffeId, trustDomain, SpiffeError } from './agent/spiffe.js'
+export {
+  verifyAgentCert,
+  defaultParseX509,
+  type MtlsVerifyResult,
+  type ParsedCert,
+  type ParseCert,
+} from './agent/verify-mtls.js'
+export { shouldRotate, DEFAULT_ROTATION_PLAN, DEFAULT_CERT_TTL_SECONDS, type RotationPlan } from './agent/rotate.js'
+
+// T10 revocation
+export { revoke, revokeToken } from './revocation/revoke.js'
+export { isTokenRevoked, killsScope } from './revocation/check.js'
+
+// T11 rate-limits
+export {
+  policyForPlan,
+  PRE_AUTH_POLICY,
+  checkPreAuthRate,
+  checkConnectRate,
+  checkConcurrentSessions,
+  checkEnrollRate,
+} from './ratelimit/quota.js'
+
+// T12 enforcement
+export { onUpgrade, type UpgradeContext, type EnforceDeps } from './enforce/onUpgrade.js'
+export { onReattach, type ReattachContext } from './enforce/onReattach.js'