user-scoped channel sessions, whatsapp disconnect cleanup, browser relay token fix

Channel session IDs now include userId (channel-{provider}-{userId}-{contextId})
to prevent cross-user contamination in multi-user setups. WhatsApp disconnect
properly logs out and clears cached auth. Browser relay uses server-derived token
directly.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/extensions/browser-relay/background-utils.js

@@ -38,8 +38,8 @@ export async function buildRelayWsUrl(host, port, gatewayToken) {
       "Missing relay token in extension settings (chrome.storage.local.relayToken)",
     );
   }
-  const relayToken = await deriveRelayToken(token, port);
-  return `ws://${host}:${port}/extension?token=${encodeURIComponent(relayToken)}`;
+  // Token is already derived server-side — use it directly
+  return `ws://${host}:${port}/extension?token=${encodeURIComponent(token)}`;
 }
 
 export function isRetryableReconnectError(err) {

src/extensions/browser-relay/options.js

@@ -1,4 +1,3 @@
-import { deriveRelayToken } from './background-utils.js'
 import { classifyRelayCheckException, classifyRelayCheckResponse } from './options-validation.js'
 
 const DEFAULT_PORT = 18792
@@ -32,11 +31,11 @@ async function checkRelayReachable(host, port, token) {
     return
   }
   try {
-    const relayToken = await deriveRelayToken(trimmedToken, port)
+    // Token is already derived server-side — use it directly
     const res = await chrome.runtime.sendMessage({
       type: 'relayCheck',
       url,
-      token: relayToken,
+      token: trimmedToken,
     })
     const result = classifyRelayCheckResponse(res, host, port)
     if (result.action === 'throw') throw new Error(result.error)