feat: 为本地 HTTP API 增加 Token 鉴权与安全加固

- 使用 Electron safeStorage 加密存储并自动初始化 API Token
- 为 health 以外的接口增加 Bearer Token 鉴权
- 限制 CORS 仅允许可信本地 Origin
- 增加鉴权、Token rotation、safeStorage 和手动验收测试

tests/e2e/support/electron-main.cjs

@@ -316,6 +316,31 @@ handle('app-log:reveal', () => undefined)
 handle('cache:getSummary', () => ({ bootstrapBytes: 0, electronBytes: 0, totalBytes: 0 }))
 handle('cache:clear', () => ({ bootstrapBytes: 0, electronBytes: 0, totalBytes: 0 }))
 handle('api:getStatus', () => ({ running: false, host: settings.apiHost, port: settings.apiPort }))
+handle('api:tokenStatus', () => ({
+  success: true,
+  available: true,
+  hasToken: true,
+  maskedToken: '••••••••••••••••'
+}))
+handle('api:revealToken', () => ({
+  available: true,
+  hasToken: true,
+  maskedToken: '••••••••••••••••',
+  token: 'fixture-api-token'
+}))
+handle('api:copyToken', () => ({
+  success: true,
+  available: true,
+  hasToken: true,
+  maskedToken: '••••••••••••••••'
+}))
+handle('api:rotateToken', () => ({
+  success: true,
+  available: true,
+  hasToken: true,
+  maskedToken: '••••••••••••••••'
+}))
+handle('api:copyCurl', () => ({ success: true }))
 handle('api:start', () => ({ running: true, host: settings.apiHost, port: settings.apiPort }))
 handle('api:stop', () => ({ running: false, host: settings.apiHost, port: settings.apiPort }))
 handle('api:toggle', (enabled) => ({