feat: rework CookieBridge to v2 architecture per CEO feedback

Architecture changes:
- Extension connects directly to server (no local proxy/daemon)
- Dual transport: WebSocket (real-time) + HTTP polling (fallback)
- Server stores encrypted cookie blobs (E2E encrypted, server-blind)
- Device registration with API token auth
- Pairing records stored server-side for cross-device cookie access
- Agent Skill API: AI agents get tokens to retrieve encrypted cookies
  with domain-level access control

New modules:
- src/relay/store.ts — encrypted cookie blob storage (LWW, per-device limits)
- src/relay/tokens.ts — device registry, agent registry, pairing tracking
- Protocol spec v2 with new types (EncryptedCookieBlob, AgentToken, etc.)

38 tests passing (crypto, pairing, conflict, full integration with
HTTP polling, agent API, and WebSocket relay).

Co-Authored-By: Paperclip <noreply@paperclip.ing>

src/index.ts

@@ -1,5 +1,7 @@
 export { RelayServer } from "./relay/index.js";
 export type { RelayServerConfig } from "./relay/index.js";
+export { CookieBlobStore } from "./relay/store.js";
+export { DeviceRegistry, AgentRegistry } from "./relay/tokens.js";
 
 export {
   generateKeyPair,
@@ -24,16 +26,22 @@ export {
   PROTOCOL_VERSION,
   MESSAGE_TYPES,
   MAX_OFFLINE_QUEUE,
+  MAX_STORED_COOKIES_PER_DEVICE,
   PAIRING_CODE_LENGTH,
   PAIRING_TTL_MS,
+  POLL_INTERVAL_MS,
 } from "./protocol/spec.js";
 export type {
   Envelope,
   MessageType,
   CookieEntry,
   CookieSyncPayload,
+  EncryptedCookieBlob,
+  DeviceRegisterRequest,
+  DeviceInfo,
   PairingRequest,
   PairingAccept,
   PairingResult,
-  DeviceInfo,
+  AgentTokenRequest,
+  AgentToken,
 } from "./protocol/spec.js";