Merge branch 'plan/e2ee' - End-to-end encryption for relay connections

Implements E2EE for relay connections only, keeping direct connections
and CLI plaintext. The relay acts as a dumb byte forwarder with no
access to decrypted messages.

Key changes:
- Daemon keypair persistence in $PASEO_HOME/daemon-keypair.json
- Encrypted relay transport using ECDH P-256 + AES-256-GCM
- Client-side E2EE using daemon's public key from pairing offer
- WebCrypto compatibility for React Native

packages/app/src/hooks/use-daemon-client.ts

@@ -9,7 +9,14 @@ function runDaemonRequest(label: string, promise: Promise<unknown>): void {
   });
 }
 
-export function useDaemonClient(url: string): DaemonClient {
+type DaemonClientOptions = {
+  daemonPublicKeyB64?: string;
+};
+
+export function useDaemonClient(
+  url: string,
+  options: DaemonClientOptions = {}
+): DaemonClient {
   const client = useMemo(
     () => {
       const tauriTransportFactory = createTauriWebSocketTransportFactory();
@@ -19,9 +26,15 @@ export function useDaemonClient(url: string): DaemonClient {
         ...(tauriTransportFactory
           ? { transportFactory: tauriTransportFactory }
           : {}),
+        e2ee: options.daemonPublicKeyB64
+          ? {
+              enabled: true,
+              daemonPublicKeyB64: options.daemonPublicKeyB64,
+            }
+          : undefined,
       });
     },
-    [url]
+    [options.daemonPublicKeyB64, url]
   );
 
   useEffect(() => {