feat(relay): rendezvous-relay service — 7 packages + plans (contracts/transport/agent/control-plane/e2e/auth/web)

Multi-tenant reverse-tunnel service ("ngrok for Claude Code" with E2E): a
host-agent dials OUT to an operator-run relay; external devices reach the host
THROUGH the relay, routed by per-tenant subdomain, forwarding ciphertext only
(the relay never sees plaintext). Lets a customer reach their own self-hosted
web-terminal from anywhere with zero networking setup.

Packages — all tsc-strict + vitest green (656 tests), cross-package integration verified:
- relay-contracts: frozen shared contracts (mux frame codec, data model,
  capability token, E2E envelope, pairing) — the src/types.ts analog
- term-relay:   native WS mux + stateless data plane (subdomain routing, ciphertext forward)
- agent:        host-agent (pairing, per-host Ed25519 + mTLS dial-out, forwards to 127.0.0.1:3000)
- control-plane: accounts/hosts registry, pairing-code flow, routing table, provisioning
- relay-e2e:    browser<->agent E2E (X25519 ECDH through relay, AEAD, anti-replay, recoverable replay key)
- relay-auth:   Passkey/WebAuthn, capability tokens, per-host certs, deny-by-default tenant isolation
- relay-web:    browser login + Web Crypto E2E + client-side preview rendering

Security invariants INV1-15 enforced; cross-tenant isolation CI tripwire live
(.github/workflows/relay-tripwire.yml). Design + implementation-level plans in
docs/PLAN_RELAY_*.md and docs/EXPLORE_RELAY_SERVICE.md.

NOTE: generated autonomously per the reviewed plans. The security-critical
packages (relay-e2e, relay-auth) REQUIRE expert security audit before any real
deployment — passing tests prove self-consistency, not resistance to attackers.
Base app (src/, public/) unchanged; concurrent desktop work left uncommitted.

relay-web/src/config.ts

@@ -0,0 +1,53 @@
+/**
+ * T1 — runtime config derived from `location` (no host/IP knob exists in the client, so the
+ * browser can never be pointed at another tenant's origin — supports INV1 upstream).
+ *
+ * The tenant origin is `<subdomain>.term.<domain>`. `wsUrl` is ALWAYS same-origin and
+ * scheme-following (`wss:` on HTTPS, else `ws:`) — the M6 guarantee that avoids mixed-content
+ * blocking on TLS/Tailscale deploys.
+ */
+import { ConfigError } from './errors'
+
+/** The label that marks the tenant zone: `<subdomain>.term.<domain>`. */
+const TENANT_ZONE_LABEL = 'term'
+
+export interface RelayWebConfig {
+  /** left-most hostname label, e.g. 'alice' in alice.term.example.com */
+  readonly subdomain: string
+  /** scheme-following, SAME-ORIGIN ws URL builder (M6); a path cannot inject a foreign host */
+  readonly wsUrl: (path: string) => string
+  /** same-origin API base ('' — every control-plane call is relative) */
+  readonly apiBase: string
+}
+
+/** Parse the tenant subdomain from a hostname, or throw (fail-fast, never default to a tenant). */
+function parseSubdomain(hostname: string): string {
+  const labels = hostname.split('.')
+  const first = labels[0]
+  // Require the `<sub>.term.<...>` shape: a non-empty left label with `term` as the 2nd label.
+  if (labels.length < 3 || labels[1] !== TENANT_ZONE_LABEL || first === undefined || first === '') {
+    throw new ConfigError(
+      `hostname '${hostname}' has no tenant subdomain (expected '<subdomain>.${TENANT_ZONE_LABEL}.<domain>')`,
+    )
+  }
+  return first
+}
+
+/**
+ * Derive the client runtime config from `location`. Throws {@link ConfigError} on a host that is
+ * not a valid tenant subdomain — it never silently falls back to another tenant's subdomain.
+ */
+export function readConfig(loc: Pick<Location, 'protocol' | 'host' | 'hostname'>): RelayWebConfig {
+  const subdomain = parseSubdomain(loc.hostname)
+  const wsScheme = loc.protocol === 'https:' ? 'wss' : 'ws'
+  const host = loc.host
+
+  const wsUrl = (path: string): string => {
+    // Always anchor to our own host; normalize to a leading '/' so a caller-supplied
+    // `//evil.com` becomes a PATH on our host, never a protocol-relative foreign origin.
+    const normalized = path.startsWith('/') ? path : `/${path}`
+    return `${wsScheme}://${host}${normalized}`
+  }
+
+  return Object.freeze({ subdomain, wsUrl, apiBase: '' })
+}