feat(relay): Add managed relay tunnels and APN service

[juliusmarminge]

Stack

• Extract collection performance refactors from mobile stack #2854 codex/collection-performance-refactors -> main (merged)
• T3 Code Mobile [WIP] #2013 t3code/mobile-remote-connect -> main
• This PR codex/relay-managed-tunnels-auth-infra -> t3code/mobile-remote-connect

Summary

This stacked draft PR adds the relay-managed tunnel and cloud authentication work on top of the mobile remote-runtime PR. General collection/performance rewrites from #2854 and the TypeScript/Effect tooling base are now on main.

• add the relay worker/infrastructure package, persistence, APNs delivery, managed endpoint provisioning, observability, migrations, and tests
• add standards-oriented relay authentication: DPoP proof handling, JWT/JWS signing and verification, OAuth-style token exchange/scopes, replay protections, and environment proof flows
• add shared client-runtime/contracts/shared modules for managed relay operation across web and Expo mobile clients
• add web, desktop, and mobile cloud linking and managed-environment flows, including mobile agent-awareness/live-activity registration
• route relay-specific hashing and randomness through effect/Crypto while retaining Expo-compatible implementations

Validation

• bun fmt
• bun lint (passes with 8 existing web warnings)
• bun lint:mobile
• bun typecheck
• cd infra/relay && bun run test (103 passed, 5 skipped)
• cd apps/mobile && bun run test (135 passed)
• cd apps/web && bun run test (1005 passed)
• cd apps/server && bun run test (1075 passed, 4 skipped)

Rebase Note

General collection/performance rewrites from #2854 are now merged into main; mobile command metadata, pairing-URL redaction, and shared-runtime Crypto cleanup remain in #2013. This PR retains the managed-relay changes to the mobile connection contract and runtime above those inherited lower-layer changes.

---

Note

High Risk
Touches authentication (Clerk OAuth, protocol callbacks, token storage), new production relay deploy, and release pipeline env wiring; mobile raises minimum iOS to 18.0.

Overview
Adds T3 Cloud as an optional, config-gated product path: root .env.example documents public Clerk/relay settings, and CI gains a production relay deploy on main plus a release job that resolves relay URL and Clerk keys into desktop, CLI, and Vercel web builds.

Desktop gains end-to-end cloud sign-in: custom URL schemes (t3code / t3code-dev), macOS launcher/protocol registration for dev, DesktopCloudAuth (state-validated callbacks, single-instance routing), encrypted Clerk JWT storage, and IPC that proxies only allowed Clerk Frontend API hosts.

Mobile integrates Clerk (CloudAuthProvider), a Settings stack (environments, waitlist, T3 Cloud connect rows), agent push notification deep-linking, Live Activity preferences synced via relay when signed in, Expo widgets/notifications plugins, and iOS deployment target 18.0. Saved environments can record relayManaged metadata.

Docs and tooling shifts: README/AGENTS/mobile README describe optional cloud setup; desktop dev launcher and window navigation send off-origin OAuth to the system browser.

^{Reviewed by Cursor Bugbot for commit ee69e93. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Add managed relay tunnels with DPoP auth, APNs live activity delivery, and cloud CLI commands

• Introduces a managed relay system where mobile and web clients connect to server environments via Cloudflare tunnels using DPoP-bound tokens; adds ManagedRelayClient, ManagedRelayDpopSigner, and platform-specific crypto/signer layers for mobile (Expo Crypto) and web (WebCrypto/IndexedDB)
• Adds a relay Cloudflare Worker (infra/relay) with HTTP APIs for environment linking, credential issuance, agent awareness publishing, and APNs delivery of live activity updates and push notifications to mobile devices
• Extends server auth (EnvironmentAuth, SessionStore, PairingGrantStore) to support DPoP-bound access tokens with replay prevention via a proof_key_thumbprint claim and per-request DPoP proof verification
• Adds t3 cloud CLI commands (status, link, auth) with relay client install/management via a bundled cloudflared binary; the CLI is conditionally exposed based on build-time public config
• Adds desktop Clerk integration: a fetch proxy routing Clerk Frontend API calls through the desktop bridge, OAuth sign-in flow with native callback handling, and encrypted JWT token storage
• Adds mobile settings screens for cloud/waitlist enrollment, environments management, and agent awareness notification permissions including iOS Live Activities widget support
• Deploys relay via a new GitHub Actions workflow on push to main; release pipeline now resolves and injects Clerk/relay public config into all build and deploy steps
• Risk: DPoP proof verification adds a secret-store write (replay guard) on every authenticated request; consuming bootstrap credentials now requires a matching proofKeyThumbprint or fails, which is a breaking change for existing pairing flows that do not supply it

^{Macroscope summarized ee69e93.}