fix: reject oversized checkout diffs (#2488)

* fix: reject oversized checkout diffs

* fix(diff): keep large previews from disconnecting clients

The physical socket limit is an OOM backstop, not a frame-size contract. Bound structured diff construction incrementally and report oversized previews without closing the client's socket.

* fix(app): preserve oversized diff state

* fix(diff): stay within relay frame limit

---------

Co-authored-by: Mohamed Boudra <boudra.moha@gmail.com>

packages/relay/src/index.ts

@@ -9,5 +9,11 @@ export {
   decrypt,
 } from "./crypto.js";
 
-export { createClientChannel, createDaemonChannel, EncryptedChannel } from "./encrypted-channel.js";
+export {
+  base64EncryptedWireByteLength,
+  createClientChannel,
+  createDaemonChannel,
+  EncryptedChannel,
+  maxBase64EncryptedPlaintextByteLength,
+} from "./encrypted-channel.js";
 export type { Transport, EncryptedChannelEvents } from "./encrypted-channel.js";