[Feature] Optional End-to-End Encryption (E2EE) for WebSocket Payloads

[BrianV1981]

Summary

Add optional client-side End-to-End Encryption (E2EE) for WebSocket terminal payloads. Even though the traffic travels over a secure TLS tunnel (Ngrok/Cloudflare/Nginx), E2EE ensures that the reverse proxy or tunnel provider cannot inspect the plaintext terminal I/O.

Implementation Details

• Generate an AES-GCM or ChaCha20 encryption key client-side (perhaps derived from the Stealth Passphrase or a separate E2EE secret).
• Encrypt all keystrokes in the browser before sending them over the WebSocket.
• The backend decrypts the payload before passing it to the pty fork.
• The backend encrypts terminal output before sending it to the client.
• This should be strictly OPTIONAL, configured via an env var (e.g. ENABLE_E2EE=true) and a UI toggle.