feat(settings): cell URL + generated cellToken for server investigations

[coccyx]

Summary

Adds a Cell URL field and a generated cell token to the Settings "Server-side investigations" card, so an operator can wire the app to the server-side investigator cell without hand-editing KV or pasting secrets on both sides by memory.

The cell authenticates every request against a shared bearer: the app-scoped KV key cellToken (injected by proxies.yml as kv.cellToken) must equal the cell's UI_BEARER secret. This PR generates that token in the browser and shows it for copy into the cell.

What changed

• Generate cell token — creates a 32-byte random hex token (openssl rand -hex 32 shape) via crypto.getRandomValues, stores it raw in the app KV store under cellToken (so the proxy injects it verbatim), and displays it read-only for copy into the cell's UI_BEARER.
• Cell URL — persists to AppSettings.cellUrl and pushes into the transport via setCellBaseUrl. Must match the domain declared in config/proxies.yml, or the platform proxy blocks the fetch.
• Corrected stale toggle text — the cell no longer self-gates on the flag (removed in cell fix(cell): don't self-gate on the serverInvestigations flag #133), so "the cell re-checks this flag on every trigger" was false; reworded to describe the re-provision behavior.
• Version bump 0.13.28 → 0.13.29 so the pack actually installs on staging.

Validate on staging

Deployed as apm-0.13.29.tgz.

1. Open the APM app → Settings → Server-side investigations card.
2. Click Generate cell token → a hex token appears in the read-only field; tap to select-all and copy.
3. (Optional) set Cell URL and Save cell URL.
4. Confirm the token persists across a reload (read back from KV cellToken on mount).

Cell side (separate infra VM)

Set the same value as the cell's UI_BEARER secret and restart the cell:

aws ssm put-parameter --profile test --region us-west-2 \
  --name /apm-cell/UI_BEARER --type SecureString \
  --value '<TOKEN_FROM_SETTINGS>' --overwrite

App KV cellToken must match cell SSM /apm-cell/UI_BEARER exactly, or the cell rejects every proxied request as unauthorized.

Known limitations

• No copy-to-clipboard button yet (sandboxed-iframe clipboard is finicky); the field is select-on-focus so long-press / Ctrl-A + copy works.
• Kept up to date as follow-on server-investigations changes land.

🤖 Generated with Claude Code