Secure the loopback canvas API

[ojowwalker77]

Summary

• rotate a cryptographically random 256-bit canvas capability every app launch and publish it through an atomically replaced mode-0600 descriptor
• validate exact loopback Host/Origin and bearer authorization before body parsing or MainActor dispatch; remove wildcard CORS and bump the API to v2
• migrate Claude, Codex, OpenCode, bundled skills, docs, Raycast, and Alfred without putting the capability in URLs, argv, board data, responses, or logs

Root cause

The listener was loopback-only but trusted every local HTTP request and returned Access-Control-Allow-Origin: *, so a browser origin could read or mutate the active board. Internal and external clients had no authentication contract.

Verification

• swift test --filter 'Canvas(ServerSecurity|ChatEngine)Tests|AgentSkillsInstallerTests' — 38 passed
• ./script/check — release build + 194 tests passed
• ./script/verify — signed release bundle validated
• ./script/build_and_run.sh --verify — staged app launched
• real-server read-only probes — 16/16 passed, including foreign/null Origin, wrong Host, simple POST, auth, descriptor permissions, relaunch rotation, and old-token rejection
• unified logs contain neither the capability nor bearer header
• Splus staged audit — 0 findings, 44/44 export contracts traced

Deliberate non-goals / risk

• /health remains unauthenticated but still enforces Host/Origin and exposes only liveness/version metadata.
• The API remains fixed to 127.0.0.1:7337; clients discover the exact base URL and launch capability from the private descriptor.
• Rollback is the single commit; API v2 is intentionally incompatible with unauthenticated v1 clients.

Closes #101