feat: route and secure hosted connections

[ByteTrue]

Linked issue

N/A — approved CodeStable Epic 002-o-retained-capabilities-delivery, Wave 1 (ITEM-01–ITEM-03).

Type of change

• Bug fix
• New feature
• Enhancement
• Refactor
• Docs

Reasoning

BySpace stable and prerelease builds need to stay on separate hosted App and Relay channels. Hosted HTTPS clients must not attempt plaintext LAN Direct connections, and Relay pairing links need a readable host name so deep-link pairing does not default to an opaque server ID.

This wave implements those three connected remote-connection requirements together while preserving custom endpoint overrides, existing Relay/TLS behavior, old pairing offers, old clients, and host identity semantics.

Goals

• Route official hosted App and Relay defaults by release channel:
  • stable: app.byspace.cc.cd + relay.byspace.cc.cd:443
  • prerelease: app-beta.byspace.cc.cd + relay-beta.byspace.cc.cd:443
• Migrate persisted official defaults to the running version's channel without changing explicit custom App, Relay, public Relay, or TLS configuration.
• Reject non-loopback plaintext Direct TCP before client/WebSocket construction from hosted HTTPS browser pages while preserving loopback, TLS, Relay, native, Electron, non-HTTPS, and daemon-bundled Web flows.
• Add optional append-only hostname to V2 pairing offers and choose labels as explicit/probed label → trimmed offer hostname → server ID.
• Preserve protocol compatibility in both directions and keep v: 2.

Non-goals

• No Relay, DNS, Cloudflare, secret, or deployment changes.
• No new RPC or connection-offer version.
• No change to server identity, duplicate matching, manual label protection, or Relay transport semantics.
• No release execution.
• No work from later Epic waves.

QA

Automated behavior evidence:

• ITEM-01:
  • Protocol focused tests: 29/29 passed.
  • Server config tests: 17/17 passed.
  • CLI local-daemon supervision tests: 6/6 passed.
  • Server connection-offer E2E: 3/3 passed.
• ITEM-02:
  • RED: hosted HTTPS accepted ws://192.168.1.20:6767/ws before the fix.
  • GREEN utility tests: 12/12 passed.
  • Host Runtime tests: 67/67 passed.
• ITEM-03:
  • Protocol connection-offer tests: 8/8 passed.
  • Host Runtime tests: 69/69 passed.
  • Server pairing-offer E2E: 3/3 passed.

Repository gates:

npm run build:server  # passed
npm run typecheck     # passed
npm run lint          # passed
npm run format        # passed
npm run format:check  # passed

Review evidence:

• Each ITEM passed an independent fresh review with 0 blocking / 0 important findings.
• The final Wave 1 aggregate diff passed a separate fresh review with 0 blocking / 0 important findings.

Platforms and limitations:

• Tested through Protocol, Server, CLI, App utility/runtime, and daemon E2E boundaries on macOS.
• No visual UI changed, so screenshots are not applicable.
• Native and Electron behavior is pinned by platform-gating tests; device/simulator packaging was not run.
• No live production Relay or Cloudflare deployment was exercised because infrastructure changes are outside this wave.

Checklist

• One focused change
• npm run typecheck passes
• npm run lint passes
• npm run format passes
• QA evidence
• Tests added or updated where it made sense