fix(app): add dev server auth token to all API endpoints

Generate random VITE_DEV_API_TOKEN in dev.sh, validate Bearer token
in shared server/dev-auth.ts middleware. Applied to all Vite plugins
(fs, dev-chats, rss, web-search, tmdb, music-search) and claude-proxy.
Client-side uses apiFetch() wrapper to attach the token automatically.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

packages/app/scripts/dev.sh

@@ -9,6 +9,11 @@ APP_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
 
 cd "$APP_DIR"
 
+# Generate a dev API token if not already set
+if [ -z "$VITE_DEV_API_TOKEN" ]; then
+  export VITE_DEV_API_TOKEN=$(openssl rand -hex 16)
+fi
+
 cleanup() {
   kill 0 2>/dev/null || true
   wait 2>/dev/null || true