feat(relay): rendezvous-relay service — 7 packages + plans (contracts/transport/agent/control-plane/e2e/auth/web)

Multi-tenant reverse-tunnel service ("ngrok for Claude Code" with E2E): a
host-agent dials OUT to an operator-run relay; external devices reach the host
THROUGH the relay, routed by per-tenant subdomain, forwarding ciphertext only
(the relay never sees plaintext). Lets a customer reach their own self-hosted
web-terminal from anywhere with zero networking setup.

Packages — all tsc-strict + vitest green (656 tests), cross-package integration verified:
- relay-contracts: frozen shared contracts (mux frame codec, data model,
  capability token, E2E envelope, pairing) — the src/types.ts analog
- term-relay:   native WS mux + stateless data plane (subdomain routing, ciphertext forward)
- agent:        host-agent (pairing, per-host Ed25519 + mTLS dial-out, forwards to 127.0.0.1:3000)
- control-plane: accounts/hosts registry, pairing-code flow, routing table, provisioning
- relay-e2e:    browser<->agent E2E (X25519 ECDH through relay, AEAD, anti-replay, recoverable replay key)
- relay-auth:   Passkey/WebAuthn, capability tokens, per-host certs, deny-by-default tenant isolation
- relay-web:    browser login + Web Crypto E2E + client-side preview rendering

Security invariants INV1-15 enforced; cross-tenant isolation CI tripwire live
(.github/workflows/relay-tripwire.yml). Design + implementation-level plans in
docs/PLAN_RELAY_*.md and docs/EXPLORE_RELAY_SERVICE.md.

NOTE: generated autonomously per the reviewed plans. The security-critical
packages (relay-e2e, relay-auth) REQUIRE expert security audit before any real
deployment — passing tests prove self-consistency, not resistance to attackers.
Base app (src/, public/) unchanged; concurrent desktop work left uncommitted.

relay-web/src/entry/dashboard-page.ts

@@ -0,0 +1,24 @@
+/**
+ * dashboard.html entry (v0.9) — host ●status list. No inline script (strict CSP).
+ */
+import { readConfig } from '../config'
+import { createApiClient } from '../api-client'
+import { mountDashboard } from '../dashboard'
+
+function boot(): void {
+  const cfg = readConfig(window.location)
+  const root = document.getElementById('dashboard')
+  if (!root) return
+  const api = createApiClient(cfg)
+  mountDashboard(root, api, {
+    onOpen: (hostId) => {
+      window.location.assign(`/term.html?host=${encodeURIComponent(hostId)}`)
+    },
+  })
+}
+
+if (document.readyState === 'loading') {
+  document.addEventListener('DOMContentLoaded', boot)
+} else {
+  boot()
+}

relay-web/src/entry/index-page.ts

@@ -0,0 +1,30 @@
+/**
+ * index.html entry — v0.8 password gate → terminal view over the passthrough transport.
+ * No inline script (strict-CSP friendly): this bundle is loaded via <script type="module">.
+ */
+import { readConfig } from '../config'
+import { mountPasswordLogin } from '../login-password'
+import { createPassthroughTransport } from '../ws-transport'
+import { mountTerminalView } from '../terminal-view'
+
+function boot(): void {
+  const cfg = readConfig(window.location)
+  const loginRoot = document.getElementById('login')
+  const termRoot = document.getElementById('terminal')
+  if (!loginRoot || !termRoot) return
+
+  mountPasswordLogin(loginRoot, cfg, {
+    onSuccess: () => {
+      loginRoot.hidden = true
+      termRoot.hidden = false
+      const transport = createPassthroughTransport(cfg)
+      void transport.open().then(() => mountTerminalView(termRoot, transport))
+    },
+  })
+}
+
+if (document.readyState === 'loading') {
+  document.addEventListener('DOMContentLoaded', boot)
+} else {
+  boot()
+}

relay-web/src/entry/manage-page.ts

@@ -0,0 +1,38 @@
+/**
+ * manage.html entry (v0.10) — CLIENT-SIDE preview grid. Server previews die under E2E; the
+ * key-holding browser decrypts a ciphertext replay and renders read-only xterms. No inline script.
+ *
+ * The §4.4 replay crypto is imported from relay-e2e (P4) and injected into the grid — cited
+ * verbatim, never re-implemented.
+ *
+ * INTEGRATION POINT: `loadReplay` must fetch the host's ciphertext ring-buffer replay + the §4.5
+ * `hostContentSecret` (delivered via P5 after auth/step-up). Those endpoints are owned by P5/P1/P3;
+ * this glue wires the shape and throws until they land, so a card shows "unavailable" rather than a
+ * fabricated screen.
+ */
+import { deriveContentKey, openReplayCiphertext } from 'relay-e2e'
+import { readConfig } from '../config'
+import { createApiClient } from '../api-client'
+import { mountPreviewGrid } from '../preview-grid'
+import type { ReplaySource } from '../preview-client'
+
+async function loadReplay(
+  _hostId: string,
+): Promise<{ replay: ReplaySource; hostContentSecret: Uint8Array }> {
+  // TODO(P5/P1): fetch ciphertext replay + hostContentSecret (post auth/step-up). Not yet available.
+  throw new Error('replay source not yet wired (pending P5/P1 endpoints)')
+}
+
+function boot(): void {
+  const cfg = readConfig(window.location)
+  const root = document.getElementById('manage')
+  if (!root) return
+  const api = createApiClient(cfg)
+  mountPreviewGrid(root, api, loadReplay, { deriveContentKey, openReplayCiphertext })
+}
+
+if (document.readyState === 'loading') {
+  document.addEventListener('DOMContentLoaded', boot)
+} else {
+  boot()
+}

relay-web/src/entry/pair-page.ts

@@ -0,0 +1,23 @@
+/**
+ * pair.html entry (v0.9) — add-machine onboarding. No inline script (strict CSP).
+ */
+import { readConfig } from '../config'
+import { createApiClient } from '../api-client'
+import { mountAddMachine } from '../add-machine'
+
+function boot(): void {
+  const cfg = readConfig(window.location)
+  const root = document.getElementById('pair')
+  if (!root) return
+  const api = createApiClient(cfg)
+  const add = mountAddMachine(root, api, {
+    onPaired: () => window.location.assign('/dashboard.html'),
+  })
+  void add.start()
+}
+
+if (document.readyState === 'loading') {
+  document.addEventListener('DOMContentLoaded', boot)
+} else {
+  boot()
+}