feat: make existing remote access a first-class flow (README, desktop entry point, tunnel guidance) #227

T3 Code already has remote access support through server mode and REMOTE.md, but it still feels like a manual/power-user flow rather than a first-class product feature.

Today, a user can build the app, start apps/server, bind a host manually, generate an auth token, and connect from another device. That works, but the feature is hard to discover and is not integrated into the normal desktop/product flow.

I’d like to request a more first-class remote-access experience for scenarios like:

• local LAN
• Cloudflare Tunnel
• Tailscale
• other reverse-proxy / tunnel setups

Why

This would make it much easier to keep T3 Code running on one machine and use it from another device without having to piece together the setup manually.

Requested scope

• Surface remote access more clearly in the main README / docs.
• Add a more discoverable remote-access entry point in the app or desktop flow.
• Make the auth story explicit for remote browser clients.
• Ensure WebSocket auth/reconnect works reliably behind reverse proxies/tunnels.
• Clarify trusted-origin / host-header behavior.
• Add recommended guidance for LAN / Tailscale / tunnel setups.

Suggested acceptance criteria

• A new user can discover that remote access exists without needing to find REMOTE.md manually.
• A user can expose T3 Code through a LAN or tunnel endpoint and connect from a second device.
• The remote client still works with auth enabled.
• WebSocket reconnect remains reliable behind the proxy/tunnel.
• The repo documents at least one supported end-to-end self-hosted remote-access path clearly.

Non-goal

This request is not asking for a hosted cloud product. It is asking for the existing remote-access capability to be easier to discover, configure, and trust.

Relevant code context

• REMOTE.md
• apps/server/src/wsServer.ts
• apps/server/src/main.ts
• apps/web/src/wsNativeApi.ts
• apps/web/vite.config.ts

Reference implementation ideas

• CodexMonitor’s optional remote backend / daemon mode
• CodexMonitor’s documented Tailscale/mobile remote-access flow