fix(relay): protect sessions against replayed commands (#7610)

Protect relay sessions against replayed commands with authenticated Noise NK negotiation, ordered records, and identity-bound security pins. Preserve legacy admission during migration and add daemon enforcement policy.

All 21 CI checks passed. General engineering review is complete; specialist cryptographic review of the handwritten Noise implementation and static-key reuse remains required before release or deployment.

Closes #359

packages/cli/src/commands/daemon/pair.ts

@@ -92,6 +92,7 @@ export async function resolveLocalPairingOffer(options: {
     relayPublicEndpoint: config.relayPublicEndpoint,
     relayUseTls: config.relayUseTls,
     relayPublicUseTls: config.relayPublicUseTls,
+    relayRequireProtectedSecurity: config.relayRequireProtectedSecurity,
     appBaseUrl: config.appBaseUrl,
     includeQr: true,
   });