fix(app): add dev server auth token to all API endpoints

Generate random VITE_DEV_API_TOKEN in dev.sh, validate Bearer token
in shared server/dev-auth.ts middleware. Applied to all Vite plugins
(fs, dev-chats, rss, web-search, tmdb, music-search) and claude-proxy.
Client-side uses apiFetch() wrapper to attach the token automatically.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

packages/app/server/claude-proxy.ts

@@ -3,6 +3,7 @@ import { createServer } from 'http'
 import { readFileSync, existsSync } from 'fs'
 import { resolve, dirname } from 'path'
 import { fileURLToPath } from 'url'
+import { validateDevAuth } from './dev-auth.js'
 
 const __dirname = dirname(fileURLToPath(import.meta.url))
 
@@ -294,6 +295,8 @@ const server = createServer((req, res) => {
     return
   }
 
+  if (!validateDevAuth(req, res)) return
+
   let body = ''
   req.on('data', (chunk) => { body += chunk })
   req.on('end', () => {

packages/app/server/dev-auth.ts

@@ -0,0 +1,18 @@
+/**
+ * Shared dev server authentication middleware.
+ * Validates Bearer token on all /api/* requests.
+ * Token is auto-generated in scripts/dev.sh and injected via VITE_DEV_API_TOKEN.
+ */
+import type { IncomingMessage, ServerResponse } from 'http'
+
+const DEV_TOKEN = process.env.VITE_DEV_API_TOKEN ?? ''
+
+/** Validate Authorization header. Returns true if authorized, false if rejected (response already sent). */
+export function validateDevAuth(req: IncomingMessage, res: ServerResponse): boolean {
+  if (!DEV_TOKEN) return true // No token configured, skip auth
+  const auth = req.headers.authorization
+  if (auth === `Bearer ${DEV_TOKEN}`) return true
+  res.writeHead(401, { 'Content-Type': 'application/json' })
+  res.end(JSON.stringify({ error: 'Unauthorized' }))
+  return false
+}