security(P0): close unauthenticated RCE chain

The local FastAPI server previously exposed macro create/execute over the
network with no authentication while bound to 0.0.0.0, and macro `app`
commands ran via subprocess with shell=True — an unauthenticated RCE for
anyone on the LAN (and, via the relay, the internet).

- Mandatory per-install auth token (secrets.token_urlsafe) required on all
  /api/* routes and the /ws handshake; timing-safe hmac.compare_digest.
  PWA shell + /static assets remain public to bootstrap.
- Token auto-generated and persisted in settings.json (now chmod 0600).
- Bind host is configurable (web.allow_lan); token is the security boundary.
- macro `app` launch no longer uses shell=True — commands are tokenized with
  shlex and exec'd directly, killing ;/&&/|/$() shell chaining.
- Relay client injects the local token and only forwards /api/* paths, and no
  longer forwards attacker-supplied headers to the local server.
- Fixed path traversal in /api/image/{path} (realpath-confined to macro_images).
- GUI embeds the token in the LAN URL/QR; PWA reads it and sends it on API,
  WebSocket, and image requests.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

gui/main_window.py

@@ -146,7 +146,12 @@ class MainWindow(QMainWindow):
         self.macro_manager = MacroManager(data_file, images_dir, app_dir)
 
         # Initialize web server
-        self.web_server = WebServer(self.macro_manager, app_dir, DEFAULT_PORT)
+        token = self.settings_manager.get_web_auth_token()
+        host = "0.0.0.0" if self.settings_manager.get_web_allow_lan() else "127.0.0.1"
+        self.web_server = WebServer(
+            self.macro_manager, app_dir, DEFAULT_PORT,
+            auth_token=token, host=host
+        )
         self.server_thread = None
 
         # Relay client (initialized later if enabled)
@@ -450,7 +455,10 @@ class MainWindow(QMainWindow):
             self.ip_label.setText(full_url)
             return
 
-        # Fall back to local IP
+        # Fall back to local IP. Append the auth token as a query param so the
+        # QR/copied URL lets a LAN device authenticate against the API.
+        token = self.settings_manager.get_web_auth_token()
+        token_qs = f"?token={token}" if token else ""
         try:
             import netifaces
             for iface in netifaces.interfaces():
@@ -459,11 +467,11 @@ class MainWindow(QMainWindow):
                     for addr in addrs[netifaces.AF_INET]:
                         ip = addr.get('addr', '')
                         if ip and not ip.startswith('127.'):
-                            self.ip_label.setText(f"http://{ip}:{DEFAULT_PORT}")
+                            self.ip_label.setText(f"http://{ip}:{DEFAULT_PORT}{token_qs}")
                             return
         except Exception:
             pass
-        self.ip_label.setText(f"http://localhost:{DEFAULT_PORT}")
+        self.ip_label.setText(f"http://localhost:{DEFAULT_PORT}{token_qs}")
 
     def copy_url_to_clipboard(self):
         """Copy the web interface URL to clipboard."""
@@ -703,7 +711,8 @@ class MainWindow(QMainWindow):
             local_port=DEFAULT_PORT,
             on_connected=self.on_relay_connected,
             on_disconnected=self.on_relay_disconnected,
-            on_session_id=self.on_relay_session_id
+            on_session_id=self.on_relay_session_id,
+            local_auth_token=self.settings_manager.get_web_auth_token()
         )
         self.relay_client.start()
         self.status_bar.showMessage("Connecting to relay server...")