feat(relay): connector⇄gateway channel auth + signed-HTTP inbound receiver + enroll CLI (#48147)

* feat(relay): authenticate the connector⇄gateway WS channel

The relay gateway may be customer-managed and internet-exposed, so the
connector⇄gateway channel is itself authenticated (distinct from the
platform crypto the relay path sheds). Add gateway/relay/auth.py — a
Python port of the connector's HMAC token + delivery-signature schemes
(relayAuthToken.ts / deliverySigning.ts), verified byte-for-byte against
the connector's compiled TypeScript via cross-language test vectors.

Present an Authorization bearer on the /relay WS upgrade keyed by the
per-gateway secret (resolved from GATEWAY_RELAY_ID / GATEWAY_RELAY_SECRET
in env or config). The connector rejects an unauthenticated/invalid/
revoked upgrade with close 4401.

* feat(relay): signed-HTTP inbound delivery receiver

The connector delivers normalized inbound events to a tenant's gateway
over a signed HTTP POST, not the outbound /relay WS: the connector
instance owning a platform socket is generally not the instance a given
gateway dialed out to, so inbound targets a tenant endpoint that may
load-balance across gateway instances.

Add gateway/relay/inbound_receiver.py — verifies x-relay-signature /
x-relay-timestamp over the EXACT raw request bytes (re-serializing would
break the HMAC: JS JSON.stringify is compact, Python json.dumps spaces)
against the per-tenant delivery key verify list within a 300s replay
window, then dispatches messages to handle_message and interrupts to the
interrupt handler. Wire it into the adapter lifecycle (start in connect()
when a delivery key + bind port are configured, tear down in disconnect();
a purely-outbound dev gateway runs without it).

Refine test_relay_sheds_crypto to distinguish PLATFORM crypto (Discord
ed25519, Twilio/WeCom HMAC — still shed) from the connector⇄gateway
CHANNEL auth (intended): auth.py / inbound_receiver.py are exempt from
the platform-symbol scan but still banned from importing platform-crypto
modules, plus a positive guard that auth.py uses only stdlib hmac/hashlib.

* feat(relay): hermes gateway enroll CLI

Add the gateway half of zero-touch enrollment. `hermes gateway enroll`
resolves a fresh Nous Portal access token (the tenant-proving identity),
POSTs {enrollmentToken, gatewayId} to the connector's /relay/enroll, and
persists GATEWAY_RELAY_ID / GATEWAY_RELAY_SECRET / GATEWAY_RELAY_DELIVERY_KEY
to ~/.hermes/.env. The per-gateway secret authenticates the WS upgrade;
the per-tenant delivery key verifies signed inbound deliveries.

Refuses under is_managed() (hosted installs get the secret stamped in by
the orchestrator). Added as an 'enroll' subcommand on the existing
gateway subparser — not a new top-level command.

* docs(relay): inbound is signed HTTP, not WS; document channel auth

Fix the stale contract: §3/§5 said inbound rode the WS socket (single-
instance only, predates the multi-instance socket-ownership + channel-auth
model). Inbound + connector→gateway interrupt are signed HTTP POSTs to the
tenant endpoint. Add §6.1 documenting the two channel-auth schemes (per-
gateway WS-upgrade secret, per-tenant inbound delivery key) and how they
differ from the platform crypto the relay path sheds.

* test(relay): update build_gateway_parser callers for cmd_gateway_enroll

The enroll subcommand added cmd_gateway_enroll as a required keyword-only
arg to build_gateway_parser, but two existing parser-extraction tests still
called it with only cmd_gateway/cmd_proxy — failing CI with TypeError.
Thread the new handler through both call sites and add a test asserting
`gateway enroll` dispatches to cmd_gateway_enroll with its flags parsed.

tests/hermes_cli/test_gateway.py

@@ -305,6 +305,7 @@ def test_gateway_run_force_flag_survives_parser_extraction():
         subparsers,
         cmd_gateway=lambda _args: None,
         cmd_proxy=lambda _args: None,
+        cmd_gateway_enroll=lambda _args: None,
     )
 
     args = parser.parse_args(["gateway", "run", "--force"])

tests/hermes_cli/test_subcommands_profile_gateway.py

@@ -20,6 +20,10 @@ def _h_proxy(args):  # pragma: no cover - identity only
     return "proxy"
 
 
+def _h_gateway_enroll(args):  # pragma: no cover - identity only
+    return "gateway_enroll"
+
+
 def _h_profile(args):  # pragma: no cover - identity only
     return "profile"
 
@@ -34,7 +38,12 @@ def _profile_parser():
 def _gateway_parser():
     p = argparse.ArgumentParser(prog="hermes")
     sub = p.add_subparsers(dest="command")
-    build_gateway_parser(sub, cmd_gateway=_h_gateway, cmd_proxy=_h_proxy)
+    build_gateway_parser(
+        sub,
+        cmd_gateway=_h_gateway,
+        cmd_proxy=_h_proxy,
+        cmd_gateway_enroll=_h_gateway_enroll,
+    )
     return p
 
 
@@ -90,3 +99,25 @@ def test_gateway_lifecycle_accepts_legacy_platform_flag():
         assert ns.gateway_command == action
         assert ns.platform == "photon"
         assert ns.func is _h_gateway
+
+
+def test_gateway_enroll_dispatch():
+    p = _gateway_parser()
+    ns = p.parse_args(
+        [
+            "gateway",
+            "enroll",
+            "--token",
+            "tok",
+            "--connector-url",
+            "wss://connector.example.com/relay",
+            "--gateway-id",
+            "gw-1",
+        ]
+    )
+    assert ns.command == "gateway"
+    assert ns.gateway_command == "enroll"
+    assert ns.func is _h_gateway_enroll
+    assert ns.token == "tok"
+    assert ns.connector_url == "wss://connector.example.com/relay"
+    assert ns.gateway_id == "gw-1"