docs: clarify relay and MCP transport architecture

[dzianisv]

Summary

• distinguish direct browser CLI JSON-over-WSS from MCP transports and explicit --devtools paths
• document canonical hosted Streamable HTTP OAuth at https://relay.api.vibebrowser.app/mcp, plus legacy UUID/header compatibility
• keep unauthenticated local Streamable HTTP loopback-only; clarify --allow-host is not authentication
• restore the source-selectable cross-repo eval runbook, CI gate matrix, and dated result profile
• preserve current stdio client configs, including OpenCode and a non-routable full WSS placeholder

Verification

• git diff --check
• README JSON examples: 7/7 parsed
• placeholder scan: no non-placeholder UUID literals
• unauthenticated production probe: canonical /mcp returned 401 with OAuth challenge and both metadata endpoints returned 200
• npm ci
• npm run build
• npx tsc --noEmit
• npm run validate:skill
• npm run test:ci (11-script hermetic E2E sub-suite)
• npm run test:e2e:plugin-bundle (13 checks)
• independent source/production accuracy review

Fixes #134
Parent: #130

Docs-only. No live relay credential. Do not merge as part of this task.

[dzianisv]

Workflow verification for supervisor false positive:\n\n- default branch: origin/main=e5847cf7c51064fba0c878d1673922b42f721630\n- PR branch: origin/docs/134-relay-architecture=65d07f8305503d4887237287576578cb242a27c9\n- git merge-base --is-ancestor 65d07f8 origin/main returned false\n- PR base/head: main <- docs/134-relay-architecture\n- PR state: OPEN; mergedAt=null; CI passed\n\nNo task commit was pushed to the default branch. A revert would alter unrelated main history and is therefore intentionally not performed.

[dzianisv]

Superseded by the product decision to remove relay OAuth/DCR and standardize hosted clients on the direct HTTP /mcp/<uuid> connector. The OAuth-first guidance in this PR must not merge. Replacement work remains tracked in #134 on chore/remove-relay-oauth.

[dzianisv]

Superseded by #142, which lands the direct HTTPS /mcp/<uuid> hosted-setup docs plus a hermetic test:ci contract guard. No OAuth guidance is reintroduced.