Add protected relay endpoint security with replay protection

Updated peers negotiate Noise_NK_25519_ChaChaPoly_SHA256 inside the
existing e2ee_hello / e2ee_ready exchange and send counter-nonced records
framed with authenticated chunk metadata. Old peers on either side fall
back to the legacy NaCl box channel while the daemon permits it.

Daemon flag daemon.relay.requireProtectedSecurity (default false,
reloadable) refuses legacy relay clients at hello time; pairing offers
and relay URIs then carry minimumSecurityMode=protected. The daemon
advertises server_info.features.relayProtectedSecurity, and a relay
client that negotiated legacy with such a daemon closes 4002 before
admission. The app pins the protected minimum per daemon public key.

Covers getpaseo/paseo#359.

packages/cli/src/commands/daemon/pair.ts

@@ -92,6 +92,7 @@ export async function resolveLocalPairingOffer(options: {
     relayPublicEndpoint: config.relayPublicEndpoint,
     relayUseTls: config.relayUseTls,
     relayPublicUseTls: config.relayPublicUseTls,
+    relayRequireProtectedSecurity: config.relayRequireProtectedSecurity,
     appBaseUrl: config.appBaseUrl,
     includeQr: true,
   });