fix(managed-runtime): secure auth and lifecycle control across runtimes (#437)

* feat: add OpenCode server authentication with auto-generated passwords

* fix(auth): separate user env and managed OpenCode password state

* fix(auth): enforce env precedence and managed password rotation across runtimes

* fix(vscode): rotate managed auth on startup and harden webview proxy

* build: add dev icons and config for Tauri desktop development

* fix(runtime): start managed OpenCode via CLI and expose active API port

* fix(managed-runtime): control OpenCode lifecycle and surface secure diagnostics

* docs: remove VS Code plugin test runbook

packages/desktop/scripts/desktop-dev.mjs

@@ -18,7 +18,16 @@ function spawnProcess(command, args, opts = {}) {
 }
 
 async function main() {
-  const tauriProcess = spawnProcess('bun', ['--cwd', desktopDir, 'tauri', 'dev', '--features', 'devtools']);
+  const tauriProcess = spawnProcess('bun', [
+    '--cwd',
+    desktopDir,
+    'tauri',
+    'dev',
+    '--features',
+    'devtools',
+    '--config',
+    './src-tauri/tauri.dev.conf.json',
+  ]);
 
   let cleaning = false;