fix(managed-runtime): secure auth and lifecycle control across runtimes (#437)

* feat: add OpenCode server authentication with auto-generated passwords

* fix(auth): separate user env and managed OpenCode password state

* fix(auth): enforce env precedence and managed password rotation across runtimes

* fix(vscode): rotate managed auth on startup and harden webview proxy

* build: add dev icons and config for Tauri desktop development

* fix(runtime): start managed OpenCode via CLI and expose active API port

* fix(managed-runtime): control OpenCode lifecycle and surface secure diagnostics

* docs: remove VS Code plugin test runbook

packages/vscode/src/ChatViewProvider.ts

@@ -204,7 +204,10 @@ export class ChatViewProvider implements vscode.WebviewViewProvider {
     let response: Response;
     let wrapAsGlobal = false;
 
-    const requestHeaders = this._buildSseHeaders(headers || {});
+    const requestHeaders = this._buildSseHeaders({
+      ...(headers || {}),
+      ...(this._openCodeManager?.getOpenCodeAuthHeaders() || {}),
+    });
 
     try {
       response = await fetch(targetUrl, {