Add audience-bound browser relay credentials

[Mathieu2301]

Summary

• replace the Firebase-direct browser token API with an atomic relay URL, access token, and expiry credential boundary
• add a browser-safe control-plane exchange provider using Firebase Auth and App Check only over HTTPS
• support same-relay reauthentication and zero-reexchange handoff when authoritative relay routing changes
• share strict bounded response parsing and document the breaking alpha migration

Security

• source credentials never enter WebSocket HELLO or REAUTH frames
• access tokens are validated as compact, short-lived credentials and can only be used with their returned canonical WSS URL
• redirects, cookies, open response shapes, duplicate JSON keys, reflected source tokens, stale leases, hostile streams, and unbounded bodies fail closed
• changed-relay credentials are never sent to the previous relay and rejected bodies are cancelled without blocking cleanup

Validation

• bun run check
• 130 tests passed
• TypeScript typecheck and production build passed
• Node and browser bundle smoke tests passed; browser bundle contains no Node imports
• 11 external coordinator contract scenarios passed
• npm package dry-run passed
• adversarial security, lifecycle, and public API/RFC reviews completed