feat: pilot agent outbound-mode for remote nodes (#667)

* feat: pilot agent outbound-mode for remote nodes

Adds a second mode for managing remote nodes: the agent dials an outbound
WebSocket tunnel to the primary, so the remote host no longer needs an
inbound port, a reachable URL, or its own TLS certificate. Works behind
NAT, residential routers, and corporate firewalls.

The primary multiplexes HTTP and WebSocket requests over a single tunnel
via a hybrid JSON + binary frame protocol, bridged through a per-tunnel
loopback server so existing proxy and upgrade handlers route pilot-mode
nodes identically to proxy-mode ones.

Enrollment uses a single-use 15-minute pilot_enroll JWT exchanged for a
long-lived pilot_tunnel credential on first connect. Proxy mode continues
to work unchanged and both modes are supported side-by-side.

* test(e2e): switch to proxy mode before asserting api_url field

Remote nodes default to Pilot Agent mode, which hides the api_url input.
The SSRF-validation tests need proxy mode, so the helper now selects
Distributed API Proxy after picking Remote type before asserting the
field is visible.

* fix(e2e): wire Combobox id prop so node-mode selector resolves

The Combobox trigger button had no id, leaving its Label orphaned and
making getByRole name-based lookups fail. Adding id to the primitive,
passing id="node-mode" from NodeManager, and updating the E2E helper to
use #node-mode fixes both the a11y regression and the CI timeout.

e2e/nodes.spec.ts

@@ -31,6 +31,9 @@ test.describe('Node management', () => {
     // #node-type is a Radix UI combobox - click to open, then pick the option.
     await page.locator('#node-type').click();
     await page.getByRole('option', { name: /remote/i }).click();
+    // Remote nodes default to Pilot Agent mode; switch to Proxy so the api_url field renders.
+    await page.locator('#node-mode').click();
+    await page.getByRole('button', { name: /distributed api proxy/i }).click();
     // Confirm the API URL field is now visible before proceeding
     await expect(page.locator('#node-api-url')).toBeVisible({ timeout: 3_000 });
     return true;