Bring ngrok public-relay security to Cloudflare Quick parity #273

Decision

Transport scope T4: retain ngrok as an explicit optional public-relay fallback.

Security requirement

ngrok must not be a weaker public transport than Cloudflare Quick. Reuse the existing relay E2E protocol and implementation rather than inventing a second cryptographic design:

• fragment-key bootstrap;
• per-pair/session key verification;
• encrypted PTY/events/control/approval payloads;
• replay protection; and
• fail-closed behavior when E2E is unavailable.

Scope

• Keep ngrok setup/status/disable only as needed for this narrow transport.
• Preserve HTTPS-only public URL validation, exact tunnel health checks, and cleanup.
• Do not add account-management features beyond the credentials/domain necessary to start the user-selected tunnel.

Acceptance criteria

• Terminal bytes, typed input, approval payloads, and controls are app-layer encrypted over ngrok; only documented relay metadata is exposed.
• Pairing or WebSocket attach cannot fall back to plaintext if the E2E key/verifier is missing or invalid.
• Doctor reports auth/binary/tunnel/E2E readiness clearly.
• Unit, relay-protocol, and real-device transport smoke coverage demonstrate the same security contract as Cloudflare Quick.