fix(app): fix broken dev server after security hardening

- Fix dev.sh unbound variable crash with ${VITE_DEV_API_TOKEN:-}
- Kill stale proxy on startup instead of skipping (token mismatch)
- Fix RSS middleware blocking all GET requests (check path before auth)
- Read dev auth token lazily from process.env (not cached at import)
- Restore network binding (host: true) for Vite dev server
- Add macOS keychain lookup for Claude Code OAuth token in proxy
- Rewrite proxy streaming to pipe SSE directly instead of await json()
- Prevent double web search (client-side + proxy) in useAI
- Reduce SearXNG timeout 6s→3s and max tries 8→3

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

packages/app/src/composables/useAI.ts

@@ -551,17 +551,22 @@ export function useAI() {
     chatStore.isStreaming = true
 
     let systemPrompt = buildSystemPrompt(chatStore)
+    let clientSearchSucceeded = false
     if (chatStore.webSearchEnabled && userText.trim()) {
       const results = await searchWeb(userText)
       if (results.length > 0) {
         systemPrompt += formatWebSearchContext(results)
         chatStore.setMessageWebResults(cid, assistantMsg.id, results)
+        clientSearchSucceeded = true
         console.log('[AIUI] Injected', results.length, 'web search results into context')
       } else {
-        console.warn('[AIUI] Web search enabled but 0 results — check browser console for [AIUI web-search] logs')
+        console.warn('[AIUI] Web search enabled but 0 results — proxy will handle search')
       }
     }
 
+    // If client-side search succeeded, don't ask the proxy to search again
+    const proxyWebSearch = chatStore.webSearchEnabled && !clientSearchSucceeded
+
     const history: ChatMessage[] = chatStore.messages
       .filter((m) => m.id !== assistantMsg.id)
       .map((m) => ({ role: m.role as 'user' | 'assistant', content: m.content, images: m.images }))
@@ -576,7 +581,7 @@ export function useAI() {
 
     try {
       if (provider === 'claude') {
-        await streamClaude(history, onToken, onError, systemPrompt, chatStore.webSearchEnabled, signal, genParams)
+        await streamClaude(history, onToken, onError, systemPrompt, proxyWebSearch, signal, genParams)
       } else if (provider === 'openrouter') {
         await streamOpenRouter(history, onToken, onError, systemPrompt, signal)
       } else {