Add headless LAN browser mode

[IgorWarzocha]

Summary

• adds packaged and dev headless/browser mode
• allows trusted LAN access with token auth and a browser login gate
• keeps the browser bridge closer to Electron preload parity
• supports browser-side attachment uploads for picked, dropped, and pasted files
• adds URL sync/back-button routing with TanStack Router
• fixes footer/sidebar/stop controls so extension status lines do not overlap them
• documents the bunx howcode --headless --host 0.0.0.0 --port 4173 flow

Notes

Remote headless mode is meant for trusted networks / Tailscale-style use, not raw internet SaaS. Browser mode still treats host filesystem, host paths, and host-side actions as host-local concepts.

Changelog updated in docs/changelog.md.

Validation

• commit hooks passed bun run ai:check repeatedly
• latest push hook passed full check: 54 files, 208 tests
• built and relaunched a temp packaged headless app
• smoke-tested LAN access, auth/token flow, routing, session tree, terminal operations, project listing, configured packages/skills, and browser upload endpoint

[IgorWarzocha]

@codex please review this PR and give me 10-20 issues if any. Categorize findings as required, recommended, or optional.

[chatgpt-codex-connector]

Codex Review: Something went wrong. Try again later by commenting “@codex review”.

This workspace is deactivated. Select an active workspace and try again.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".