fix(managed-runtime): secure auth and lifecycle control across runtimes (#437)

* feat: add OpenCode server authentication with auto-generated passwords

* fix(auth): separate user env and managed OpenCode password state

* fix(auth): enforce env precedence and managed password rotation across runtimes

* fix(vscode): rotate managed auth on startup and harden webview proxy

* build: add dev icons and config for Tauri desktop development

* fix(runtime): start managed OpenCode via CLI and expose active API port

* fix(managed-runtime): control OpenCode lifecycle and surface secure diagnostics

* docs: remove VS Code plugin test runbook

packages/web/bin/cli.js

@@ -450,6 +450,23 @@ function isProcessRunning(pid) {
   }
 }
 
+async function requestServerShutdown(port) {
+  if (!Number.isFinite(port) || port <= 0) return false;
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), 1500);
+  try {
+    const resp = await fetch(`http://127.0.0.1:${port}/api/system/shutdown`, {
+      method: 'POST',
+      signal: controller.signal,
+    });
+    return resp.ok;
+  } catch {
+    return false;
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+
 const commands = {
   async serve(options) {
     options.port = await resolveAvailablePort(options.port);
@@ -675,6 +692,7 @@ const commands = {
       console.log(`Stopping OpenChamber (PID: ${targetInstance.pid}, Port: ${targetInstance.port})...`);
 
       try {
+        await requestServerShutdown(targetInstance.port);
         process.kill(targetInstance.pid, 'SIGTERM');
 
         let attempts = 0;
@@ -709,6 +727,7 @@ const commands = {
         console.log(`  Stopping instance on port ${instance.port} (PID: ${instance.pid})...`);
 
         try {
+          await requestServerShutdown(instance.port);
           process.kill(instance.pid, 'SIGTERM');
 
           let attempts = 0;
@@ -814,6 +833,7 @@ const commands = {
 
       // Stop the instance
       try {
+        await requestServerShutdown(instance.port);
         process.kill(instance.pid, 'SIGTERM');
         // Wait for it to stop
         let attempts = 0;
@@ -970,6 +990,7 @@ const commands = {
       console.log(`\nStopping ${runningInstances.length} running instance(s) before update...`);
       for (const instance of runningInstances) {
         try {
+          await requestServerShutdown(instance.port);
           process.kill(instance.pid, 'SIGTERM');
           let attempts = 0;
           while (isProcessRunning(instance.pid) && attempts < 20) {