fix(managed-runtime): secure auth and lifecycle control across runtimes (#437)

* feat: add OpenCode server authentication with auto-generated passwords

* fix(auth): separate user env and managed OpenCode password state

* fix(auth): enforce env precedence and managed password rotation across runtimes

* fix(vscode): rotate managed auth on startup and harden webview proxy

* build: add dev icons and config for Tauri desktop development

* fix(runtime): start managed OpenCode via CLI and expose active API port

* fix(managed-runtime): control OpenCode lifecycle and surface secure diagnostics

* docs: remove VS Code plugin test runbook

packages/ui/src/hooks/useEventStream.ts

@@ -486,7 +486,7 @@ export const useEventStream = () => {
     // Note: needs_attention logic is now handled by the server
     // Server maintains authoritative state based on view tracking and message events
 
-    if (prevType !== nextType) {
+    if (process.env.NODE_ENV === 'development' && prevType !== nextType) {
       try {
         console.info('[SESSION-STATUS]', {
           sessionId,