Allow self-hosted relays to opt into wss:// (#767)

* Add relay TLS schema fields

* Wire relay TLS into websocket URLs

* Propagate relay TLS from pairing offers

* Expose relay TLS opt-in

* Mark relay TLS fallback for removal

* Preserve explicit relay TLS false

* Align relay TLS defaults outside config loader

docs/data-model.md

@@ -133,7 +133,7 @@ Single file, validated with `PersistedConfigSchema`.
     hostnames: true | string[],
     mcp: { enabled: boolean },
     cors: { allowedOrigins: string[] },
-    relay: { enabled: boolean, endpoint: string, publicEndpoint: string }
+    relay: { enabled: boolean, endpoint: string, publicEndpoint: string, useTls: boolean }
   },
   app: {
     baseUrl: string