新增: df-tunnel Phase2 WS隧道客户端(出站穿NAT+Hello握手+收发循环)

- WsTunnelClient: connect_async连df-relay /ws/device + Hello(HelloKind::Device)
- 握手探测(HANDSHAKE_PROBE 3s):无负帧=relay静默通过 / error帧=Auth失败 / Close=Connect失败
- 收发循环: socket入帧→parse_command_from_broadcast提payload(kind=command)→on_command回调; mpsc出帧→socket写; heartbeat 25s Ping
- cleanup_conn: Close帧+500ms等task+abort兜底; connected用Arc<AtomicBool>共享
- backoff_delay(1→2→4→8→16→30s cap)预留Phase3 supervisor自动重连
- 协议对齐 df-relay(Hello字段/方向Event↔Command/payload透传),cargo check零warning+4测试通过

crates/df-tunnel/src/events.rs

@@ -11,6 +11,44 @@
 
 use serde::{Deserialize, Serialize};
 
+/// 握手身份宣告帧(对齐 df-relay::relay::Hello)
+///
+/// 桌面端 WS 连 `/ws/device` 后,首条消息发此 JSON,relay 校验 kind 与 token。
+/// 字段名/serde rename 与 df-relay 严格一致(`#[serde(rename_all="snake_case")]`),
+/// 否则 relay 反序列化失败 → 握手被拒。
+///
+/// 注意:本 crate 不依赖 df-relay(避免 lib→server 反向依赖),自行镜像协议结构。
+/// 协议字段如有变更须同步 df-relay::relay::Hello 与本类型。
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct Hello {
+    /// 客户端类型("device" / "miniapp"),桌面端恒为 Device
+    pub kind: HelloKind,
+    /// 配对绑定的设备 ID
+    pub device_id: String,
+    /// 配对 token(env DF_RELAY_TOKEN 同源)
+    pub token: String,
+}
+
+/// Hello.kind 传输表示(serde 字符串,与 df-relay::ClientKindWire 一致)
+#[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "snake_case")]
+pub enum HelloKind {
+    Device,
+    Miniapp,
+}
+
+/// relay 控制面错误帧(握手失败时 relay 发送)
+///
+/// relay 在校验失败/连接异常时发 `{"kind":"control","error":"<reason>"}` 文本帧。
+/// 桌面端据此识别握手失败原因(不依赖 error 帧亦可:连接被 Close 即视为失败)。
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct RelayControlError {
+    /// 固定 "control"(用于与正常 BroadcastMessage 区分,relay 错误帧简化为两字段)
+    pub kind: String,
+    /// 错误原因(handshake_failed / kind_mismatch / auth_failed)
+    pub error: String,
+}
+
 /// 隧道透传的事件类型(AiChatEvent 简化子集)
 ///
 /// 变体语义对齐桌面端 ai-chat-event: