fix(app): fix broken dev server after security hardening

- Fix dev.sh unbound variable crash with ${VITE_DEV_API_TOKEN:-}
- Kill stale proxy on startup instead of skipping (token mismatch)
- Fix RSS middleware blocking all GET requests (check path before auth)
- Read dev auth token lazily from process.env (not cached at import)
- Restore network binding (host: true) for Vite dev server
- Add macOS keychain lookup for Claude Code OAuth token in proxy
- Rewrite proxy streaming to pipe SSE directly instead of await json()
- Prevent double web search (client-side + proxy) in useAI
- Reduce SearXNG timeout 6s→3s and max tries 8→3

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

packages/app/scripts/dev.sh

@@ -10,7 +10,7 @@ APP_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
 cd "$APP_DIR"
 
 # Generate a dev API token if not already set
-if [ -z "$VITE_DEV_API_TOKEN" ]; then
+if [ -z "${VITE_DEV_API_TOKEN:-}" ]; then
   export VITE_DEV_API_TOKEN=$(openssl rand -hex 16)
 fi
 
@@ -23,13 +23,14 @@ trap cleanup EXIT INT TERM
 # Use local node_modules binaries
 BIN="$APP_DIR/node_modules/.bin"
 
-# Start Claude proxy in background (skip gracefully if already running on :3141)
+# Kill stale proxy from previous session (it has a different auth token)
 if lsof -ti:3141 > /dev/null 2>&1; then
-  echo "  Claude proxy already running on :3141 — skipping"
-else
-  "$BIN/tsx" server/claude-proxy.ts &
+  echo "  Killing stale Claude proxy on :3141"
+  kill $(lsof -ti:3141) 2>/dev/null || true
   sleep 0.3
 fi
+"$BIN/tsx" server/claude-proxy.ts &
+sleep 0.3
 
 # Start Vite dev server in background (host binding controlled by vite.config.ts / VITE_HOST)
 "$BIN/vite" &