feat: 为本地 HTTP API 增加 Token 鉴权与安全加固

- 使用 Electron safeStorage 加密存储并自动初始化 API Token
- 为 health 以外的接口增加 Bearer Token 鉴权
- 限制 CORS 仅允许可信本地 Origin
- 增加鉴权、Token rotation、safeStorage 和手动验收测试

tests/e2e/app.spec.ts

@@ -114,6 +114,25 @@ test('NAV-01 NAV-02 every top-level page is unique and switchable', async () =>
   }
 })
 
+test('API-01 masks, reveals, and confirms rotation of the local API token', async () => {
+  const fixture = await launchTestApp()
+  try {
+    await fixture.page.getByRole('button', { name: 'API' }).click()
+    await expect(fixture.page.getByText('API Token', { exact: true })).toBeVisible()
+    await expect(fixture.page.getByText('••••••••••••••••')).toBeVisible()
+    await expect(fixture.page.getByText('fixture-api-token')).toHaveCount(0)
+
+    await fixture.page.getByRole('button', { name: '显示 Token' }).click()
+    await expect(fixture.page.getByText('fixture-api-token')).toBeVisible()
+
+    fixture.page.once('dialog', (dialog) => dialog.accept())
+    await fixture.page.getByRole('button', { name: '重新生成 Token' }).click()
+    await expect(fixture.page.getByText('Token 已生成')).toBeVisible()
+  } finally {
+    await fixture.close()
+  }
+})
+
 test('EXPORT-01 multi-chat selection stays local to export and forces HTML', async () => {
   const fixture = await launchTestApp()
   try {