Daemon: drop RELAY_SECRET; auth via HF token only

Harden: per-session workers, SIGINT-children (keep session), stdin /dev/null, exact marker, put size cap, shell reaper, telemetry off

daemon: handle put/get file transfers

daemon: default client id = user@ip