fix(managed-runtime): secure auth and lifecycle control across runtimes (#437)

* feat: add OpenCode server authentication with auto-generated passwords

* fix(auth): separate user env and managed OpenCode password state

* fix(auth): enforce env precedence and managed password rotation across runtimes

* fix(vscode): rotate managed auth on startup and harden webview proxy

* build: add dev icons and config for Tauri desktop development

* fix(runtime): start managed OpenCode via CLI and expose active API port

* fix(managed-runtime): control OpenCode lifecycle and surface secure diagnostics

* docs: remove VS Code plugin test runbook

packages/vscode/src/sessionActivityWatcher.ts

@@ -191,11 +191,13 @@ export const startGlobalEventWatcher = async (
         }
 
         const url = buildOpenCodeUrl('/global/event', baseUrl);
+        const authHeaders = manager.getOpenCodeAuthHeaders();
         upstream = await fetch(url, {
           headers: {
             Accept: 'text/event-stream',
             'Cache-Control': 'no-cache',
             Connection: 'keep-alive',
+            ...authHeaders,
           },
           signal,
         });