feat: 为本地 HTTP API 增加 Token 鉴权与安全加固

- 使用 Electron safeStorage 加密存储并自动初始化 API Token
- 为 health 以外的接口增加 Bearer Token 鉴权
- 限制 CORS 仅允许可信本地 Origin
- 增加鉴权、Token rotation、safeStorage 和手动验收测试

src/preload/index.d.ts

@@ -445,6 +445,10 @@ declare global {
         port: number
         error?: string
       }>
+      apiTokenStatus: () => Promise<import('../shared/local-api-auth').ApiTokenStatus>
+      revealApiToken: () => Promise<import('../shared/local-api-auth').ApiTokenRevealResult>
+      copyApiToken: () => Promise<import('../shared/local-api-auth').ApiTokenActionResult>
+      rotateApiToken: () => Promise<import('../shared/local-api-auth').ApiTokenActionResult>
       apiStart: (
         host?: string,
         port?: number
@@ -469,6 +473,9 @@ declare global {
       revealReaderSkill: () => Promise<{ success: boolean; error?: string }>
       openReaderSkillGithub: () => Promise<{ success: boolean; error?: string }>
       testLocalApiRequest: (request: LocalApiTestRequest) => Promise<LocalApiTestResponse>
+      copyLocalApiCurl: (
+        request: LocalApiTestRequest
+      ) => Promise<import('../shared/local-api-test').LocalApiCurlCopyResult>
       copyText: (text: string) => Promise<{ success: boolean; error?: string }>
       // ============================================================
       // AI 图片理解基础设施(ImageInsightService)