Generate random VITE_DEV_API_TOKEN in dev.sh, validate Bearer token in shared server/dev-auth.ts middleware. Applied to all Vite plugins (fs, dev-chats, rss, web-search, tmdb, music-search) and claude-proxy. Client-side uses apiFetch() wrapper to attach the token automatically. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>