feat(server): add Cloudflare WSS remote backend flow

[Fanzzzd]

Summary

• add Cloudflare quick-tunnel backend support for remote WSS access
• add desktop Server UX for Public WSS setup (install, tunnel, daemon, connect steps)
• harden managed tunnel cleanup to avoid killing unrelated cloudflared processes

[xkonjin]

Quick review pass:

• Main risk area here is auth/session state and stale credential handling.
• Good to see test coverage move with the code; I’d still make sure it exercises the unhappy path around auth/session state and stale credential handling rather than only the happy path.
• Before merge, I’d smoke-test the behavior touched by README.md, codex_monitor_daemon.rs, transport.rs (+24 more) with malformed input / retry / rollback cases, since that’s where this class of change usually breaks.