feat(auth): harden auth security and add remember-me login

Improve auth hook security: restructure URL classification to fix
/_web/* bypass when requireAuth is active, use HMAC-SHA256 for constant-
time token comparison, remove dead webModeEnabled code.

Improve frontend auth flow: extract initializeApp() with watch-based
re-init after login, add getToken callback for real-time store reads,
unify SSE 401 handling via fetchWithAuth, switch default storage to
sessionStorage, add router guard consuming meta.public.

Add "Remember this device" checkbox on login page with dual
localStorage/sessionStorage strategy and safety warning.

Add 23 unit tests for auth hook matrix and http client.

Co-authored-by: Cursor <cursoragent@cursor.com>

package.json

@@ -39,6 +39,7 @@
     "type-check:node": "tsc --noEmit -p apps/desktop/tsconfig.node.json",
     "type-check:all": "pnpm run type-check:web && pnpm run type-check:node",
     "type-check": "vue-tsc --noEmit -p tsconfig.web.json",
+    "test:auth": "tsx --test apps/cli/src/http/auth.test.ts src/services/utils/http.test.ts",
     "test:agent-context": "node --experimental-strip-types --test apps/desktop/main/ai/context/sessionLog.test.mjs",
     "test:e2e:launcher": "node --test tests/e2e/helpers/app-launcher.test.js",
     "test:e2e:smoke": "node tests/e2e/run-smoke.js"