feat: implement CookieBridge M1 — core protocol & relay server

- Protocol spec: encrypted envelope format, device identity (Ed25519 + X25519),
  LWW conflict resolution with Lamport clocks
- E2E encryption: XChaCha20-Poly1305 via sodium-native, X25519 key exchange
- WebSocket relay server: stateless message forwarding, device auth via
  challenge-response, offline message queuing, ping/pong keepalive
- Device pairing: time-limited pairing codes, key exchange broker via HTTP
- Sync protocol: envelope builder/opener, conflict-resolving cookie store
- 31 tests passing (crypto, pairing, conflict resolution, full integration)

Co-Authored-By: Paperclip <noreply@paperclip.ing>

src/cli.ts

@@ -0,0 +1,21 @@
+import { RelayServer } from "./relay/index.js";
+
+const port = parseInt(process.env.PORT ?? "8080", 10);
+const host = process.env.HOST ?? "0.0.0.0";
+
+const server = new RelayServer({ port, host });
+
+server.start().then(() => {
+  console.log(`CookieBridge relay server listening on ${host}:${port}`);
+});
+
+process.on("SIGINT", async () => {
+  console.log("\nShutting down...");
+  await server.stop();
+  process.exit(0);
+});
+
+process.on("SIGTERM", async () => {
+  await server.stop();
+  process.exit(0);
+});