Allow self-hosted relays to opt into wss:// (#767)

* Add relay TLS schema fields

* Wire relay TLS into websocket URLs

* Propagate relay TLS from pairing offers

* Expose relay TLS opt-in

* Mark relay TLS fallback for removal

* Preserve explicit relay TLS false

* Align relay TLS defaults outside config loader

packages/cli/src/commands/daemon/local-daemon.supervision.test.ts

@@ -77,4 +77,23 @@ describe("local daemon launch supervision", () => {
     expectSupervisorLaunch(argv);
     expect(argv).toContain("--no-mcp");
   });
+
+  test("relay TLS flag is passed to the supervised daemon", async () => {
+    mocks.spawnSync.mockReturnValue({ status: 0, error: undefined });
+
+    const { startLocalDaemonForeground } = await import("./local-daemon.js");
+    const status = startLocalDaemonForeground({
+      home: "/tmp/paseo-test",
+      relayUseTls: true,
+    });
+
+    expect(status).toBe(0);
+    const [, argv, options] = mocks.spawnSync.mock.calls[0] as [
+      string,
+      string[],
+      { env?: NodeJS.ProcessEnv },
+    ];
+    expect(argv).toContain("--relay-use-tls");
+    expect(options.env?.PASEO_RELAY_USE_TLS).toBe("true");
+  });
 });