Merge branch 'plan/e2ee' - End-to-end encryption for relay connections

Implements E2EE for relay connections only, keeping direct connections
and CLI plaintext. The relay acts as a dumb byte forwarder with no
access to decrypted messages.

Key changes:
- Daemon keypair persistence in $PASEO_HOME/daemon-keypair.json
- Encrypted relay transport using ECDH P-256 + AES-256-GCM
- Client-side E2EE using daemon's public key from pairing offer
- WebCrypto compatibility for React Native

packages/app/src/utils/daemon-endpoints.ts

@@ -1,9 +1,22 @@
 import { Buffer } from "buffer";
+import {
+  buildDaemonWebSocketUrl,
+  buildRelayWebSocketUrl as buildSharedRelayWebSocketUrl,
+  deriveLabelFromEndpoint,
+  extractHostPortFromWebSocketUrl,
+  normalizeHostPort,
+  parseHostPort,
+  type HostPortParts,
+} from "@server/shared/daemon-endpoints";
 
-export type HostPortParts = {
-  host: string;
-  port: number;
-  isIpv6: boolean;
+export type { HostPortParts };
+
+export {
+  buildDaemonWebSocketUrl,
+  deriveLabelFromEndpoint,
+  extractHostPortFromWebSocketUrl,
+  normalizeHostPort,
+  parseHostPort,
 };
 
 function decodeBase64UrlToUtf8(input: string): string {
@@ -17,98 +30,6 @@ export function decodeOfferFragmentPayload(encoded: string): unknown {
   return JSON.parse(json) as unknown;
 }
 
-export function parseHostPort(input: string): HostPortParts {
-  const trimmed = input.trim();
-  if (!trimmed) {
-    throw new Error("Host is required");
-  }
-
-  // IPv6: [::1]:6767
-  if (trimmed.startsWith("[")) {
-    const match = trimmed.match(/^\[([^\]]+)\]:(\d{1,5})$/);
-    if (!match) {
-      throw new Error("Invalid host:port (expected [::1]:6767)");
-    }
-    const host = match[1].trim();
-    const port = Number(match[2]);
-    if (!host) throw new Error("Host is required");
-    if (!Number.isInteger(port) || port < 1 || port > 65535) {
-      throw new Error("Port must be between 1 and 65535");
-    }
-    return { host, port, isIpv6: true };
-  }
-
-  const match = trimmed.match(/^(.+):(\d{1,5})$/);
-  if (!match) {
-    throw new Error("Invalid host:port (expected localhost:6767)");
-  }
-  const host = match[1].trim();
-  const port = Number(match[2]);
-  if (!host) throw new Error("Host is required");
-  if (!Number.isInteger(port) || port < 1 || port > 65535) {
-    throw new Error("Port must be between 1 and 65535");
-  }
-  return { host, port, isIpv6: false };
-}
-
-export function normalizeHostPort(input: string): string {
-  const { host, port, isIpv6 } = parseHostPort(input);
-  if (isIpv6) {
-    return `[${host}]:${port}`;
-  }
-  return `${host}:${port}`;
-}
-
-export function extractHostPortFromWebSocketUrl(wsUrl: string): string {
-  const parsed = new URL(wsUrl);
-  if (parsed.protocol !== "ws:" && parsed.protocol !== "wss:") {
-    throw new Error("Invalid WebSocket URL protocol");
-  }
-  if (parsed.pathname.replace(/\/+$/, "") !== "/ws") {
-    throw new Error("Invalid WebSocket URL (expected /ws path)");
-  }
-
-  const host = parsed.hostname;
-  const port = parsed.port ? Number(parsed.port) : parsed.protocol === "wss:" ? 443 : 80;
-  if (!host) {
-    throw new Error("Invalid WebSocket URL (missing hostname)");
-  }
-  if (!Number.isInteger(port) || port < 1 || port > 65535) {
-    throw new Error("Invalid WebSocket URL (invalid port)");
-  }
-
-  const isIpv6 = host.includes(":") && !host.startsWith("[") && !host.endsWith("]");
-  const hostPort = isIpv6 ? `[${host}]:${port}` : `${host}:${port}`;
-  return hostPort;
-}
-
-function shouldUseSecureWebSocket(port: number): boolean {
-  return port === 443;
-}
-
-export function buildDaemonWebSocketUrl(endpoint: string): string {
-  const { host, port, isIpv6 } = parseHostPort(endpoint);
-  const protocol = shouldUseSecureWebSocket(port) ? "wss" : "ws";
-  const hostPart = isIpv6 ? `[${host}]` : host;
-  return `${protocol}://${hostPart}:${port}/ws`;
-}
-
 export function buildRelayWebSocketUrl(params: { endpoint: string; sessionId: string }): string {
-  const { host, port, isIpv6 } = parseHostPort(params.endpoint);
-  const protocol = shouldUseSecureWebSocket(port) ? "wss" : "ws";
-  const hostPart = isIpv6 ? `[${host}]` : host;
-  const url = new URL(`${protocol}://${hostPart}:${port}/ws`);
-  url.searchParams.set("session", params.sessionId);
-  url.searchParams.set("role", "client");
-  return url.toString();
+  return buildSharedRelayWebSocketUrl({ ...params, role: "client" });
 }
-
-export function deriveLabelFromEndpoint(endpoint: string): string {
-  try {
-    const { host } = parseHostPort(endpoint);
-    return host || "Unnamed Host";
-  } catch {
-    return "Unnamed Host";
-  }
-}
-