Add desktop peer connection foundation

[sambitcreate]

Aiden currently exposes remote access to mobile clients but has no desktop outbound connection registry. This adds the first backend slice for a desktop to pair with and address other Aiden installations through the existing authenticated Remote API.

The main process owns encrypted peer storage, pinned HTTPS, installation identity verification and a closed operation vocabulary. Requests capture their host, have bounded resource limits, and respect disconnect, shutdown and renderer-document cancellation. Mac/Linux pairing types retain existing grants. Tests exercise the production pairing router over HTTPS and native clients’ manual-pairing cryptographic fixture.

Scope

This is not the complete multi-host feature. Production sidebar aggregation, host/folder selection, ChatPane adaptation, live cross-origin run control, terminal leases, reconnect/replay integration and Linux combined-branch validation remain outstanding. Existing device-owned stream authorization is unchanged. Manual payload decryption and SSE framing are infrastructure only, not complete user flows.

The checked-in plan tracks remaining work. docs/design/desktop-connections-proposal.html is an interactive sample-data proposal approved by the user on 2026-09-09; it is not production integration.

Validation

• 14 focused peer tests pass, including host isolation, identity mismatch, real HTTPS pairing, storage failure, shutdown during disk load and independent cancellation.
• Remote suites: 358 service/contract tests and 7 transport-spike tests pass; one legacy-port test skips because port 65535 is occupied.
• TypeScript, lint, IPC tests and production build pass.
• Focused Android client/installation tests pass using Android Studio's JBR.
• Physical-iPad XCTest was attempted but could not start because Xcode could not mount the developer disk image. No simulator fallback was used.
• Interactive proposal checked in Chromium at desktop and 390px widths, including host/folder selection and offline send state.

This PR is ready for review of the foundation scope; the full feature remains in progress.

Two fresh-context security/adversarial reviewers found protocol header, idempotency, document-lifetime, cross-host pairing lock, shutdown and shared-cancellation defects. These are fixed with regression coverage; the final security recheck found no additional concrete defects within this foundation's scope.

[pullfrog]

Important

Strong foundation — identity pinning, pairing, encrypted storage, and cancellation all held up under adversarial analysis. One real defect: the shipped SSE framing surface has quadratic parsing with no absolute deadline, which a paired host can use to saturate the main-process CPU for minutes (latent today — no production caller passes onFrame yet — but it is the exact surface the next stream-subscription slice wires in). Two smaller notes inline.

Reviewed changes

• Peer registry & encrypted store — PeerHostRegistry + EncryptedPeerHostStorage: single-document encrypted atomic persistence, per-host/global concurrency bounds, epoch-fenced cancellation and identity re-verification, fail-closed Linux storage, credential-free renderer views.
• Pinned HTTPS/SSE transport — PeerTransport: leaf SPKI + private-CA pinning over the standard checkServerIdentity path, redirect rejection, bounded JSON/frame sizes, exercised against a real HTTPS server running the production pairing router.
• Pairing — canonical QR-payload parsing and sealed-envelope decryption cross-checked against the native clients' shared manual-pairing-vector.json; mac/linux device types accepted server-side with unchanged legacy grants.
• IPC & contracts — five remote:peers* channels with document-lifetime cancellation, closed operation table over existing authenticated routes, OpenAPI/docs/plan updates, and Mac/Linux device labels in the two inbound-device UIs. New peer tests are correctly chained into test:aiden-remote → pretest, so CI coverage is real.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using DeepSeek Flash ｜ 𝕏}

[pullfrog]

ℹ️ Minor suggestions only.

Reviewed changes

New commit 6397b486 records the user's 2026-09-09 approval of the interactive Connections/sidebar/composer UI proposal across the plan index (docs/plans/README.md) and the plan header/narrative, and the PR body moves from "Draft scope" to a ready-for-review framing. Docs-only delta; nothing behavioral.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using DeepSeek Flash ｜ 𝕏}

[pullfrog]

✅ No new issues found — all four findings from the prior Pullfrog reviews are addressed in 5ef3d28d with correct implementations and regression coverage. I verified each fix against the code, ran the focused suites (17/17 pass), and confirmed every operation validator compiles against the checked-in schema.

Reviewed changes

• Linear SSE framing — replaced the quadratic regex rescan with PeerEventFrames, a per-byte scanner with 1 MiB/frame, 16 MiB + 16,384-frame session budgets, a 30 s per-frame deadline re-armed at every boundary (heartbeats included), and a 300 s absolute session cap; clock-controlled regression tests exercise both deadlines over real HTTPS plus one-byte trickle and heartbeat-flood bounds.
• Schema-validated operation results — removed the recursive secret-key scan (which false-positived on legitimate content); every response now passes structural limits then a whole-envelope Ajv2020 validation against the checked-in OpenAPI 3.1 success schema, with validators compiled lazily and cached. All 20 ops map to a single unambiguous 2xx schema; malformed-DTO and legitimate-content tests cover every operation.
• Pairing expiry skew tolerance — assertPeerPairingExpiry allows a bounded ±2-minute client-clock window (expiry in [now − 120 s, now + 420 s]), shared by payload parsing and the registry admission re-check, with the server exchange remaining authoritative.
• Docs & plan consistency — the plan's UI inventory now records the approved proposal direction while requiring fresh approval for material departures; the API doc describes the new framing and validation bounds.

  ^{｜ View workflow run ｜ Using DeepSeek Flash ｜ 𝕏}