feat(server+cli): terminal streaming protocol and relay

[rixzkiye]

Summary

Layer 2 of 6, stacked on #1666. Adds the server/CLI streaming plane and now places the daemon behind HAPPY_TERMINAL_ENABLED off by default, so intermediate stack layers cannot expose the feature before final hardening.

• Socket.IO terminal relay scoped by user, with one writer seat and view-only enforcement.
• Machine RPCs for create, approve, attach, list, close, and policy.
• Encrypted daemon streaming for input, resize, signal, ACKs, output, and reconnect registration.
• Daemon lifecycle wiring, gated by HAPPY_TERMINAL_ENABLED.

Atomic commits unique to this layer

1. build(server): add socket.io-client dev dependency for terminal relay tests
2. feat(server): add terminal streaming relay with writer lock and metrics
3. feat(cli): add terminal RPC handlers and encrypted streaming frames to daemon
4. feat(cli): wire persistent terminal manager into daemon lifecycle
5. feat(cli): gate remote terminals behind HAPPY_TERMINAL_ENABLED

Validation — 2026-08-11

• pnpm --filter happy test — 88 files / 818 tests passed.
• pnpm --filter happy-server typecheck — passed.
• pnpm --filter happy-server test — 13 files / 99 tests passed.
• Merge-tree with current origin/main — clean.

Review this layer

Unique diff: rixzkiye/happy@feat/remote-terminal...feat/terminal/2-protocol

Stack workflow

Because these contributor branches live in a fork and I do not have push access to slopus/happy, GitHub requires every upstream PR to target main. Descendant PRs therefore show cumulative diffs.

Only the first unmerged layer is ready for review. Later layers stay draft. After each parent lands, I will restack descendants onto the updated main before promoting the next PR; this remains correct whether maintainers rebase-merge or squash-merge.

Merge order: #1666 → #1667 → #1668 → #1669 → #1670 → #1671.

#1671 upgrades the intermediate transport here to the final protocol-v3 epoch, ACK/NACK, replay, and writer-fencing contract.