feat(rpc): add optional WebRTC fast path

[tarik02]

What changed

• Added an optional WebRTC DataChannel transport for the existing WsRpcGroup, negotiated through the authenticated control WebSocket.
• Added configurable ICE servers. STUN defaults to Cloudflare, while TURN stays disabled unless T3CODE_WEBRTC_TURN_URLS is set. Optional TURN username and credential values are passed to Werift, browser WebRTC, and React Native WebRTC.
• Replaced synchronous WebRTC validation throws with typed Effects and retained underlying causes when transport errors cross module boundaries.
• Kept the control WebSocket authoritative for authentication and signaling. Once WebRTC binds and passes its probe, the authenticated RTC session survives a later control WebSocket disconnect.
• Added an always-visible transport icon before the active environment name. WebSocket is shown with a green cable, WebRTC with a blue radio tower, and hovering the full icon and name opens an interactive connection-details tooltip.
• Routed initial shell and thread subscription snapshots over RTC when selected, while retaining HTTP behavior for WebSocket sessions and older thread pages.
• Added bounded binary fragmentation, binding tokens, cooldown, focused tests, real-peer integration coverage, and internal documentation.

Why

Remote clients currently send application RPC traffic through the WebSocket endpoint even when the client and environment can establish a faster WebRTC path. This adds an optional upgrade without changing authentication, relay bootstrap, or connection targets. If direct ICE cannot connect, operators can configure TURN. If WebRTC still fails, the existing WebSocket remains selected without a connection error.

An established RTC session no longer drops solely because its signaling WebSocket disconnects. The existing supervisor still reconnects after the selected DataChannel itself closes, without replaying in-flight mutations.

Verification

• Focused WebRTC, RPC session, server config, snapshot, and toolbar tests: 136 passed across 14 files.
• Real authenticated WebSocket-to-WebRTC server integration: 1 passed, 125 skipped by the focused filter. It closes the control WebSocket before proving RTC unary RPC, configuration identity, and the streaming shell snapshot.
• Client runtime, server, and web typechecks: passed. Server output contains eight pre-existing Effect suggestions in unrelated orchestration files.
• Changed-file lint, formatting, and diff checks: passed.
• Server bundle and web production build: passed. The web build retains its existing large-chunk warning.
• Earlier branch verification also passed mobile typecheck and Expo Android prebuild with react-native-webrtc.
• Native Android build remains unavailable because Java is not installed. iOS builds are unavailable on the Linux host.
• Live proxied-browser verification kept the same connected RTC peer after explicitly closing the control WebSocket, sent a later probe through it, and did not open a replacement WebSocket.

Checklist

• This PR is focused on the optional RPC transport fast path
• I explained what changed and why
• The status UI was verified in the running web app

Model: GPT-5; harness: Codex.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4b9a7b142f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Do not gate readiness on optional WebRTC negotiation

When the server advertises this default-enabled capability but UDP/STUN traffic is blocked, selectWebRtc can run until its 10-second timeout, and session.ready waits for this call before ConnectionDriver publishes the already-authenticated WebSocket session. Users on restrictive firewalls therefore remain stuck in “synchronizing” for up to 10 seconds on every new session instead of receiving the promised immediate WebSocket fallback; negotiation failures also do not activate the cooldown. Run the upgrade without blocking WebSocket readiness, or apply a much shorter bounded selection window and cooldown failures.

AGENTS.md reference: AGENTS.md:L17-L19

Useful? React with 👍 / 👎.

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	10.5 KiB	10.7 KiB	+240 B (+2.2%)	15.1 KiB	✅
Codex	Thread snapshot wire	4.8 KiB	4.8 KiB	+6 B (+0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	5.7 KiB	5.9 KiB	+234 B (+4.0%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	50.2 KiB	51.7 KiB	+1.5 KiB (+3.0%)	66.4 KiB	✅
Codex	Live turn messages	9	11	+2 (+22.2%)	21	✅
Claude	Total thread wire	10.7 KiB	10.7 KiB	−2 B (−0.0%)	15.1 KiB	✅
Claude	Thread snapshot wire	4.8 KiB	4.8 KiB	−1 B (−0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	5.9 KiB	5.9 KiB	−1 B (−0.0%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	52.6 KiB	52.6 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	11	11	0 (0.0%)	21	✅

Baseline: 69fb998 · PR result: 7c05b28 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 76.2 KiB
• Claude decoded thread snapshot: 76.6 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.