SB-992: add auth_challenge/auth_response protocol messages

[rbonestell]

Summary

Resolves SB-992 (security finding A4) — shared protocol piece.

Adds the two wire-protocol messages for the connect-time key-possession handshake used by the agent and mobile app.

Changes

• AuthChallengeEvent { type: 'auth_challenge', nonce: string } (host → mobile).
• AuthResponseRequest { type: 'auth_response', mac: string } (mobile → host).
• nonce and mac are base64 strings, bounded by MAX_AUTH_BLOB_LENGTH (128) and validated in decode.
• Note documents the deliberate isRequest asymmetry: the security gate lives on the agent (Go IsRequest excludes auth_response); the mobile never decodes or re-sends it.

Test Plan

• npm test — round-trip + validation tests pass (incl. new auth_challenge/auth_response cases).

Cross-repo

Consumed by pocketmux-mobile; mirrored manually in pmux-agent.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[codecov-commenter]

Welcome to Codecov 🎉

Once you merge this PR into your default branch, you're all set! Codecov will compare coverage reports and display results in all future pull requests.

ℹ️ You can also turn on project coverage checks and project coverage reporting on Pull Request comment

Thanks for integrating Codecov - We've got you covered ☂️