fix(managed-runtime): secure auth and lifecycle control across runtimes (#437)

* feat: add OpenCode server authentication with auto-generated passwords

* fix(auth): separate user env and managed OpenCode password state

* fix(auth): enforce env precedence and managed password rotation across runtimes

* fix(vscode): rotate managed auth on startup and harden webview proxy

* build: add dev icons and config for Tauri desktop development

* fix(runtime): start managed OpenCode via CLI and expose active API port

* fix(managed-runtime): control OpenCode lifecycle and surface secure diagnostics

* docs: remove VS Code plugin test runbook

packages/ui/src/lib/debug.ts

@@ -264,11 +264,29 @@ export const debugUtils = {
       const resp = await fetch('/api/health');
       const contentType = resp.headers.get('content-type') || '';
       const body = await safeText(resp);
+      const isJson = contentType.toLowerCase().includes('application/json');
+      let parsed: Record<string, unknown> | null = null;
+      if (isJson && body) {
+        try {
+          const candidate = JSON.parse(body) as unknown;
+          if (candidate && typeof candidate === 'object' && !Array.isArray(candidate)) {
+            parsed = candidate as Record<string, unknown>;
+          }
+        } catch {
+          parsed = null;
+        }
+      }
       opencodeHealth = {
         status: resp.status,
         ok: resp.ok,
         contentType,
-        type: contentType.includes('application/json') ? 'json' : 'html',
+        type: isJson ? 'json' : 'html',
+        openCodePort: parsed?.openCodePort ?? null,
+        openCodeRunning: parsed?.openCodeRunning ?? null,
+        openCodeSecureConnection: parsed?.openCodeSecureConnection ?? null,
+        openCodeAuthSource: parsed?.openCodeAuthSource ?? null,
+        isOpenCodeReady: parsed?.isOpenCodeReady ?? null,
+        lastOpenCodeError: parsed?.lastOpenCodeError ?? null,
         preview: body ? body.slice(0, 120) : null,
       };
     } catch (error) {