refactor(remote-connect): unify GitHub identity and device-owned connections

[bobleer]

Summary

Remote Connect now uses the same GitHub identity as Desktop, CLI, MiniApp Market, and Skin Market. Model and configuration state stays on the device that executes the work; the account cloud-sync feature is removed.

• Share the authenticated Relay implementation between the official endpoint and embedded LAN hosts. Both use device invitations, account-scoped discovery, and encrypted device messaging.
• Update Desktop, CLI, mobile web, Android, iOS, and HarmonyOS clients; remove the anonymous room transport, Ngrok connection path, and redundant mobile-web scanner.
• Consolidate the connection center, device lists, login copy, and chat-provider entry icons. Keep desktop QR links usable through a phone's camera.
• Add isolated versioned Relay deployment assets and neutral GitHub authorization routing; preserve community deployment scripts.

Type and Areas

Refactor / UI / authentication and remote-control fixes. Rust services and contracts, Desktop, CLI, Web UI, mobile clients, markets, and deployment documentation.

Motivation / Impact

Account identity, host selection, and runtime configuration previously followed different paths. Users now sign in with GitHub, choose a device, and operate that device's workspace and settings. Official and LAN connections differ by endpoint while sharing the transport implementation.

Verification

• pnpm run check:web, pnpm run lint:web, and pnpm run build:web — passed after merging current upstream main.
• pnpm --dir src/web-ui run test:run — all 710 files / 5,396 tests passed using Node 24.
• pnpm --dir src/web-ui exec vitest run --maxWorkers=50% src/app/components/RemoteConnectDialog src/infrastructure/remote-connect/remoteConnectionState.test.ts — 98 passed.
• pnpm run check:core-boundaries, pnpm run capabilities:check, pnpm run capabilities:test, pnpm run i18n:audit — passed.
• pnpm --dir src/mobile-web run test:ui-components, test:account-login, test:workspace-identity, type-check, and pnpm run build:mobile-web — passed on the feature branch.
• cargo test --locked -p openbitfun-cli — the complete CLI package test suite passed, including all 40 CLI command contracts.
• Focused Rust regressions: 19 remote-surface registry tests, 10 CLI peer refusal tests, and the Desktop runtime-ownership test passed after the CI fixes.
• cargo test -p openbitfun-relay-service — 106 tests passed during implementation, including actual loopback authenticated HTTP/WebSocket paths.
• Browser visual checks covered compact, tablet, and desktop widths, both themes, login/device states, QR invitations, and Telegram/Feishu/WeChat forms using real components with mocked host IO.
• Deployed mobile static assets matched local build hashes. Public versioned Relay health returned 200; unauthenticated device access returned 401. The pre-existing Relay instance was left running unchanged.

Reviewer Notes

The versioned endpoint isolates the new authenticated transport from the existing deployed Relay. The old room protocol and cloud-sync feature are intentionally retired in the new clients. Review upgrade/deployment guidance with mixed client versions in mind.

Known follow-up: mobile-web sign-in uses a popup and tab-scoped credentials; expired-session recovery still needs improvement. This PR does not claim that flow is fully resolved. Full GitHub consent with two physical devices was not exercised; live SSH-workspace, Peer Device, and Detached Dispatch end-to-end scenarios were not rerun for the final UI changes.

AI-assisted implementation; testing includes focused automated suites, browser visual checks, loopback transport tests, and deployment smoke checks. CI will validate the final PR merge state.

Checklist

• This PR is focused and does not include secrets, temporary prompts, generated scratch files, or unrelated artifacts.
• Relevant verification is recorded above, or skipped checks are explained.
• User-facing strings, docs, and locales are updated where applicable.