fix(app): fix broken dev server after security hardening

- Fix dev.sh unbound variable crash with ${VITE_DEV_API_TOKEN:-}
- Kill stale proxy on startup instead of skipping (token mismatch)
- Fix RSS middleware blocking all GET requests (check path before auth)
- Read dev auth token lazily from process.env (not cached at import)
- Restore network binding (host: true) for Vite dev server
- Add macOS keychain lookup for Claude Code OAuth token in proxy
- Rewrite proxy streaming to pipe SSE directly instead of await json()
- Prevent double web search (client-side + proxy) in useAI
- Reduce SearXNG timeout 6s→3s and max tries 8→3

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

packages/app/server/dev-auth.ts

@@ -5,13 +5,12 @@
  */
 import type { IncomingMessage, ServerResponse } from 'http'
 
-const DEV_TOKEN = process.env.VITE_DEV_API_TOKEN ?? ''
-
 /** Validate Authorization header. Returns true if authorized, false if rejected (response already sent). */
 export function validateDevAuth(req: IncomingMessage, res: ServerResponse): boolean {
-  if (!DEV_TOKEN) return true // No token configured, skip auth
+  const token = process.env.VITE_DEV_API_TOKEN ?? ''
+  if (!token) return true // No token configured, skip auth
   const auth = req.headers.authorization
-  if (auth === `Bearer ${DEV_TOKEN}`) return true
+  if (auth === `Bearer ${token}`) return true
   res.writeHead(401, { 'Content-Type': 'application/json' })
   res.end(JSON.stringify({ error: 'Unauthorized' }))
   return false