feat(relay): rendezvous-relay service — 7 packages + plans (contracts/transport/agent/control-plane/e2e/auth/web)

Multi-tenant reverse-tunnel service ("ngrok for Claude Code" with E2E): a
host-agent dials OUT to an operator-run relay; external devices reach the host
THROUGH the relay, routed by per-tenant subdomain, forwarding ciphertext only
(the relay never sees plaintext). Lets a customer reach their own self-hosted
web-terminal from anywhere with zero networking setup.

Packages — all tsc-strict + vitest green (656 tests), cross-package integration verified:
- relay-contracts: frozen shared contracts (mux frame codec, data model,
  capability token, E2E envelope, pairing) — the src/types.ts analog
- term-relay:   native WS mux + stateless data plane (subdomain routing, ciphertext forward)
- agent:        host-agent (pairing, per-host Ed25519 + mTLS dial-out, forwards to 127.0.0.1:3000)
- control-plane: accounts/hosts registry, pairing-code flow, routing table, provisioning
- relay-e2e:    browser<->agent E2E (X25519 ECDH through relay, AEAD, anti-replay, recoverable replay key)
- relay-auth:   Passkey/WebAuthn, capability tokens, per-host certs, deny-by-default tenant isolation
- relay-web:    browser login + Web Crypto E2E + client-side preview rendering

Security invariants INV1-15 enforced; cross-tenant isolation CI tripwire live
(.github/workflows/relay-tripwire.yml). Design + implementation-level plans in
docs/PLAN_RELAY_*.md and docs/EXPLORE_RELAY_SERVICE.md.

NOTE: generated autonomously per the reviewed plans. The security-critical
packages (relay-e2e, relay-auth) REQUIRE expert security audit before any real
deployment — passing tests prove self-consistency, not resistance to attackers.
Base app (src/, public/) unchanged; concurrent desktop work left uncommitted.

relay-auth/src/ratelimit/quota.ts

@@ -0,0 +1,109 @@
+/**
+ * T11 · Rate-limits / quotas. Two layers (Finding-5):
+ *  1. PRE-AUTH throttle keyed on the salted `remoteAddrHash` — the ONLY identifier before a
+ *     principal exists. Applied in T12 `onUpgrade` BEFORE token verification. Blunts subdomain
+ *     enumeration, capability-verifier brute-force, and WebAuthn/TOTP guessing DoS.
+ *  2. PER-TENANT quotas keyed strictly on the authenticated `accountId` (INV3), never a client id.
+ *
+ * Pre-auth and per-tenant keys live in DISJOINT namespaces (no bleed). Keys are OPAQUE to the store.
+ */
+import type { PlanTier } from 'relay-contracts'
+import type { RateLimitPolicy, TokenBucketStore } from '../types.js'
+
+const SECONDS_PER_MINUTE = 60
+const SECONDS_PER_HOUR = 3600
+
+/** Fixed, plan-independent pre-auth policy (no account known yet). */
+export const PRE_AUTH_POLICY: RateLimitPolicy = {
+  connectPerMin: 30,
+  enrollPerHour: 10,
+  maxConcurrentSessions: 1,
+  maxPairedHosts: 1,
+  preAuthPerMinPerIp: 60,
+  totpMaxFailsPerWindow: 5,
+  totpLockoutWindowSec: 300,
+}
+
+const PLAN_POLICIES: Readonly<Record<PlanTier, RateLimitPolicy>> = {
+  free: {
+    connectPerMin: 20,
+    enrollPerHour: 5,
+    maxConcurrentSessions: 2,
+    maxPairedHosts: 1,
+    preAuthPerMinPerIp: 60,
+    totpMaxFailsPerWindow: 5,
+    totpLockoutWindowSec: 300,
+  },
+  personal: {
+    connectPerMin: 60,
+    enrollPerHour: 20,
+    maxConcurrentSessions: 5,
+    maxPairedHosts: 5,
+    preAuthPerMinPerIp: 60,
+    totpMaxFailsPerWindow: 5,
+    totpLockoutWindowSec: 300,
+  },
+  pro: {
+    connectPerMin: 120,
+    enrollPerHour: 60,
+    maxConcurrentSessions: 20,
+    maxPairedHosts: 25,
+    preAuthPerMinPerIp: 120,
+    totpMaxFailsPerWindow: 5,
+    totpLockoutWindowSec: 300,
+  },
+  team: {
+    connectPerMin: 300,
+    enrollPerHour: 200,
+    maxConcurrentSessions: 100,
+    maxPairedHosts: 200,
+    preAuthPerMinPerIp: 240,
+    totpMaxFailsPerWindow: 5,
+    totpLockoutWindowSec: 300,
+  },
+}
+
+export function policyForPlan(plan: PlanTier): RateLimitPolicy {
+  return PLAN_POLICIES[plan]
+}
+
+/** PRE-AUTH throttle keyed on `remoteAddrHash`. false = throttled (caller returns 429-equiv). */
+export function checkPreAuthRate(
+  remoteAddrHash: string,
+  store: TokenBucketStore,
+  now: number,
+): Promise<boolean> {
+  const perMin = PRE_AUTH_POLICY.preAuthPerMinPerIp
+  return store.take(`preauth:ip:${remoteAddrHash}`, perMin / SECONDS_PER_MINUTE, perMin, now)
+}
+
+/** PER-TENANT connect rate keyed on the authenticated accountId (INV3). */
+export function checkConnectRate(
+  accountId: string,
+  policy: RateLimitPolicy,
+  store: TokenBucketStore,
+  now: number,
+): Promise<boolean> {
+  const perMin = policy.connectPerMin
+  return store.take(`connect:acct:${accountId}`, perMin / SECONDS_PER_MINUTE, perMin, now)
+}
+
+/** Concurrent-session cap (synchronous; caller supplies the live count). */
+export function checkConcurrentSessions(
+  _accountId: string,
+  active: number,
+  policy: RateLimitPolicy,
+): boolean {
+  return active < policy.maxConcurrentSessions
+}
+
+/** Enrollment rate keyed on the authenticated accountId (INV3). */
+export function checkEnrollRate(
+  accountId: string,
+  policy: RateLimitPolicy,
+  store: TokenBucketStore,
+  now: number,
+): Promise<boolean> {
+  const perHour = policy.enrollPerHour
+  return store.take(`enroll:acct:${accountId}`, perHour / SECONDS_PER_HOUR, perHour, now)
+}