fix(app): add dev server auth token to all API endpoints

Generate random VITE_DEV_API_TOKEN in dev.sh, validate Bearer token
in shared server/dev-auth.ts middleware. Applied to all Vite plugins
(fs, dev-chats, rss, web-search, tmdb, music-search) and claude-proxy.
Client-side uses apiFetch() wrapper to attach the token automatically.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

packages/app/src/composables/useAI.ts

@@ -7,6 +7,7 @@ import { usePersonaStore } from '@/stores/personas'
 import { useMemoryStore } from '@/stores/memory'
 import { useArchy } from '@/composables/useArchy'
 import { useCodeContext } from '@/composables/useCodeContext'
+import { apiFetch } from '@/utils/api-fetch'
 
 type Provider = 'claude' | 'openrouter' | 'mock'
 
@@ -47,7 +48,7 @@ async function refreshWavlakeCatalog() {
   if (Date.now() - wavlakeFetchedAt < WAVLAKE_REFRESH_INTERVAL && wavlakeCatalog.value.length > 0) return
   try {
     const BASE = import.meta.env.BASE_URL || '/'
-    const res = await fetch(`${BASE}api/music/rankings?days=30&limit=40`)
+    const res = await apiFetch(`${BASE}api/music/rankings?days=30&limit=40`)
     if (!res.ok) return
     const data = await res.json()
     if (Array.isArray(data)) {
@@ -236,7 +237,7 @@ async function streamClaude(
   if (params?.topP !== undefined) body.top_p = params.topP
   if (params?.stopSequences && params.stopSequences.length > 0) body.stop_sequences = params.stopSequences
 
-  const res = await fetch(CLAUDE_PATH, {
+  const res = await apiFetch(CLAUDE_PATH, {
     method: 'POST',
     headers,
     body: JSON.stringify(body),
@@ -285,7 +286,7 @@ async function streamOpenRouter(
     headers['Authorization'] = `Bearer ${vaultKey}`
   }
 
-  const res = await fetch(OPENROUTER_PATH, {
+  const res = await apiFetch(OPENROUTER_PATH, {
     method: 'POST',
     headers,
     body: JSON.stringify({
@@ -460,7 +461,7 @@ async function generateAutoTitle(conversationId: string) {
     const vaultKey = await getApiKey('claude')
     if (vaultKey) headers['x-api-key'] = vaultKey
 
-    const res = await fetch(CLAUDE_PATH, {
+    const res = await apiFetch(CLAUDE_PATH, {
       method: 'POST',
       headers,
       body: JSON.stringify({