Harden local AI proxy with session token

[shadowbipnode]

Generate a per-session local token in the trusted Electron path and require it for calls to the localhost AI proxy, while preserving dev/browser fallback behavior.