security: enforce approved​-client bearer tokens and origin​-bound access

[JoshuaMorris]

Summary

Hardens localhost API security by requiring per-application bearer tokens on protected routes and binding token use to approved origins. Also improves dashboard/settings UX and single-window behavior.

Closes #1.

Security Changes

• Added AccessControlManager for approved clients, persisted tokens, allowed origins, and endpoint scope.
• Enforced bearer token authorization for /v1/* and /api/* routes.
• Bound token usage to approved origin hosts.
• Kept/extended host + origin validation and browser missing-Origin protection.
• Pairing verification now returns an origin-specific API token for approved web origin clients.
• Updated internal app callers (chat, relay proxy, dashboard test) to send local app token.

UX / Reliability

• Embedded settings as a dashboard tab with improved layout and token management controls.
• Dashboard/chat moved to single-instance windows to avoid duplicate window spam.
• Synced pairing code state to prevent stale code display.
• Port fallback range now stays in dedicated local API range (11434-11444), avoiding common dev ports like 8080.

Validation

• Manual security verification completed:
  • missing token -> 401
  • invalid token -> 401
  • valid token -> 200
  • disallowed origin -> 403
  • browser-style missing Origin -> 403
  • invalid Host header -> 403
  • CORS preflight allow/deny behavior correct
  • token rotation/disable behavior correct
  • token-origin binding behavior correct
  • pairing verify returns token with valid code/origin
• Chat payload script strings render as plain text (no webview/script execution path).