Add Telegram relay proxy: WebSocket→TCP circumvention system

[miclawene]

Implements a complete relay infrastructure that routes Telegram traffic
through WebSocket/HTTPS connections to bypass DPI-based blocking:

relay-server/

• server.js: Node.js WebSocket→TCP relay; pipes WS binary frames to
  Telegram DC TCP sockets; DC selected via /dc/<1-5> path; optional
  auth token; metrics endpoint; graceful shutdown; no payload logging
• decoy-site/index.html: convincing analytics landing page served for
  plain HTTP requests to avoid fingerprinting
• nginx.conf: TLS termination, WSS proxy, rate limiting, security headers
• Dockerfile + docker-compose.yml: production-ready Docker stack with
  certbot auto-renewal; non-root container; resource limits
• .env.example, README.md

web-client/

• src/transport/relay-config.ts: relay server list with DNS TXT polling
  for live updates and automatic deduplication
• src/transport/relay-transport.ts: drop-in WebSocket shim with
  per-server retry, exponential backoff, and multi-server failover;
  queues sends during reconnect
• src/patch-instructions.md: step-by-step WebK integration guide
• build.sh: clones WebK, copies transport files, patches WS constructor,
  runs production build

infrastructure/

• setup.sh: full VPS bootstrap (Docker, UFW, certbot, nginx, stack start)
• monitoring.sh: health checks for relay HTTP, WS, Telegram DC TCP
  reachability, TLS expiry, Docker containers, and metrics
• rotate-domain.sh: zero-downtime domain rotation with DNS validation,
  cert issuance, and nginx reload
• cloudflare-setup.md: domain fronting guide (proxy, WebSocket, origin
  cert, IP allowlist, WAF rules)

https://claude.ai/code/session_014WSDo9fRv8firccXSrvDjp