feat(web): relay --auth-file with robot keys, viewer tokens, and the … - #3953

…cockpit login

A relay that can be exposed: `--auth-file auth.json` maps robot ids to keys
and viewer names to tokens (static secrets, >= 16 chars, no secret twice,
constant-time compares, never logged). Robots and viewers present them in
the hello (`hello.token`, optional, <= 256 chars, no version bump); the
relay answers `auth_failed`, which is terminal on both clients. `/api/stats`
needs `Authorization: Bearer <viewer token>` and drops its CORS header once
auth is on. A non-loopback host binds with cert + key + auth together (or
`--unsafe-non-loopback` as before) and refuses `--serve-dir` there.

Bridge: `GlobalConfig.relay_key` (`RELAY_KEY`, mirrored on
`RelayBridgeConfig`, external relay only) rides `RelayClient.hello(token=)`;
an over-long token is refused before pydantic can quote it. `dimos
show-config` masks `relay_key` and `dimos_api_key`. `RelayProcess(auth_file=)`
joins the relay's read scope.

SDK: `connect({token})`, `TransportPhase.failed.code`. Cockpit: the token
form on `auth_failed` (stored in localStorage, page reload), "log out" in
the status bar.

Tests: deno auth/session/server (hello cases, stats bearer, mode gate),
fixtures with a token hello, pytest mirror + e2e + CLI masking, vitest
SDK/cockpit, and a Playwright login flow (added to the CI list).