feat: add independent TLS control for relay public endpoint (#1045)

* feat: add independent TLS control for relay public endpoint

Add PASEO_RELAY_PUBLIC_USE_TLS env var and publicUseTls persisted
config to separately control TLS for the client→relay pairing offer,
falling back to relayUseTls when unset. The daemon→relay connection
continues to use PASEO_RELAY_USE_TLS alone.

Enables self-hosting behind a TLS-terminating reverse proxy where
the internal path is plain ws:// but public clients need wss://.

* fix: use public relay TLS in daemon status

---------

Co-authored-by: Mohamed Boudra <boudra.moha@gmail.com>

packages/cli/src/commands/daemon/pair.ts

@@ -29,6 +29,7 @@ export async function runPairCommand(options: PairOptions): Promise<void> {
     relayEndpoint: config.relayEndpoint,
     relayPublicEndpoint: config.relayPublicEndpoint,
     relayUseTls: config.relayUseTls,
+    relayPublicUseTls: config.relayPublicUseTls,
     appBaseUrl: config.appBaseUrl,
     includeQr: true,
   });