#6340 fix(relay): resolve the flagged relay in every consumer

Closes every relay-resolution gap found in the audit — the class of bug behind "automations can't reach my machine": when a host moves to an overridden relay (relay-url-override), every path that reaches it must resolve the same flag, or it silently dials the default relay and fails.

Server (tRPC)

• Extract resolveUserRelayUrl(userId); route host.relayEndpoint, automation.runNow, and scheduled dispatch through it. runNow (the manual "Run now" button) had the same hardcoded-env.RELAY_URL bug as scheduled dispatch (fixed separately in #6337).

CLI

• resolveHostTarget built remote-host URLs from env.RELAY_URL, so every command targeting a remote host (workspaces/terminals/projects/agents --host X) missed a host on an overridden relay. Made it async, threaded the api client through all ~17 call sites, and resolve getRelayUrl in the remote branch only (local targets skip it).

Web

• Allowlist the relay2 origin in the CSP connect-src. The runtime relay comes from the flag while the header is built at compile time, so a flag-pointed relay was blocked — same fix already applied to the desktop CSP.

Mobile

• host.relayEndpoint resolved once after sign-in and cached; the URL builders read the cache with the Expo env as fallback. (iOS-only, not actively used, but no longer silently pinned to the default relay.)

Note

All of these become unnecessary once relay2 answers on relay.superset.sh (the hostname cutover), since every env.RELAY_URL becomes correct automatically. Until then, a host on relay2 has to be reachable from every client — which is what this PR ensures.

Verified: full typecheck clean across trpc/cli/web/mobile (excluding 3 pre-existing cross-package stale-build errors unrelated to this change), bun run lint exits 0.

Summary by CodeRabbit

• New Features
  • Relay connections can now use a user-specific relay URL when configured.
  • Automation runs and host connections honor personalized relay settings.
  • Mobile apps automatically discover and cache the appropriate relay.
  • CLI commands resolve remote host, workspace, project, terminal, and automation connections through the selected relay.
  • If no valid personalized relay is available, the default relay is used automatically.
  • Improved support for connecting to remote resources across relay endpoints.