LR-EDIT-DETAIL-DENOISE: run tiles on another computer's graphics card

- `lightcraft_denoise::remote`: protocol v1 over TCP (JSON lines + byte-shuffled,
  deflated half-float tiles), a `Remote` client (connection pool, four slots,
  greeting checks the model's SHA-256 and tile size, gives up after three failed
  tiles) and `serve` (shared token compared in constant time, size caps including
  payloads that inflate past their tile, connection limit, timeouts).
- Engine: with LIGHTCRAFT_DENOISE_URL / LIGHTCRAFT_DENOISE_TOKEN set, the loaded
  model greets the server on first use and adds its slots to this computer's
  tiles at once; a tile goes to a free server slot, else runs here, and a tile
  the server fails runs here too. `denoise.status` → `device.remote` says where.
- `lightcraft-cli denoise-serve` serves the installed, selected model on this
  computer's card (checked against the CPU, as in the app) or CPU.
- docs/denoise.md: setup, safety (unencrypted: VPN/LAN only) and the protocol.

Tested: protocol round trips, refusals (token, model, tile size, hostile
payloads), fallback and give-up; the engine model with a live, a mismatched
and a dead server; the CLI binary serving a synthetic model end to end.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/denoise.md

@@ -121,6 +121,46 @@ LC_DENOISE_MODEL=<model.onnx> LC_DENOISE_RAW=<corpus/raw> cargo test --release -
 LC_DENOISE_MODEL=<model.onnx> LC_DENOISE_RAW=<corpus/raw> cargo test --release -p lightcraft-engine --features rawnind-model --test denoise_real -- --ignored --nocapture
 ```
 
+## Another computer's graphics card
+
+A laptop can hand tiles to a desktop with a bigger graphics card over a LAN or a VPN. The server runs the installed,
+selected model the way the app does (the card when it can run it, checked against the CPU first; else the CPU):
+
+```text
+export LIGHTCRAFT_DENOISE_TOKEN='a long random string, at least 16 characters'
+lightcraft-cli denoise-serve --listen 100.101.102.103:7990          # e.g. the machine's Tailscale address
+```
+
+On the laptop, before LightCraft starts:
+
+```text
+export LIGHTCRAFT_DENOISE_URL=100.101.102.103:7990
+export LIGHTCRAFT_DENOISE_TOKEN='…the same token…'
+```
+
+The server's slots (four tiles in flight) are added to the laptop's own: a tile goes to the server when one of its
+slots is free and runs locally otherwise, so a server behind a slow link still adds speed instead of costing it. A
+tile the server fails runs locally; after three failures the server is no longer used for that model. Both ends must
+run the same model file: the client compares the manifest's SHA-256 (or the file's) when it first greets the server,
+and the server checks it again for every tile. `denoise.status` → `device.remote` reports the server's address, its
+device and whether it is used, or why not.
+
+**The protocol is not encrypted.** Listen on a VPN address (Tailscale, WireGuard) or a LAN, or bind every interface
+behind a firewall rule that admits only the VPN; never expose the port to the internet. Requests carry the shared
+token (compared in constant time); the server refuses other models, other tile sizes, oversized headers and payloads
+(also ones that inflate past their tile) and caps concurrent connections (`--max-connections`, default 8).
+
+Protocol version 1 (`crates/denoise/src/remote.rs`): one JSON line per message, then a payload of `bytes` bytes —
+the tile's samples as little-endian half floats, byte-shuffled (low bytes, then high bytes) and deflated:
+
+```text
+→ {"v":1,"token":"…","op":"hello"}
+← {"ok":true,"v":1,"device":"GPU: …","model":{"id":"…","version":"…","sha256":"…"},"tile":T}
+→ {"v":1,"token":"…","op":"run","model":"<sha256>","tile":T,"bytes":N}   + N bytes (4 planes of T × T cells)
+← {"ok":true,"tile":T,"bytes":N}                                        + N bytes (3 planes of 2T × 2T pixels)
+← {"ok":false,"error":"…"}
+```
+
 ## Commands and limits
 
 UI, CLI, control channel and MCP dispatch `denoise.toggle`, `denoise.settings`,