AGENT MANAGEMENT: feat(control): let a local agent manage the app

[sunrisegm]

Summary

• Add a separate App control setting that publishes the desktop management routes at http://127.0.0.1:{port}/byok/app/v1.
• A local agent can configure the app, add models, and call the same paths the window uses (/models, /plugins, /settings, /harness/cursor).
• The API can be off, open, or protected with a generated or pasted key using either Authorization: Bearer or X-Api-Key. The desktop window keeps using its internal routes.

Test plan

• Open Settings and confirm the App control card is separate from the model external API.
• With the API off, GET /byok/app/v1/models returns 403 and the settings window still loads.
• Enable it without authorization and add a model through POST /byok/app/v1/models.
• Turn authorization on, generate a key, choose Bearer, and confirm only Authorization: Bearer is accepted.
• Switch the method to X-Api-Key and confirm Bearer is rejected.

Made with Cursor