v1.0.1 — fix: tools panel did nothing

Fixes the headline bug in v1.0.0: none of the tools worked.

panel.html is served raw from the app's assets, so panel.js's __RC_TOKEN__ placeholder was never replaced with the per-launch session nonce — only the page-side scripts got that substitution. Every call the panel made to the native bridges presented the literal string __RC_TOKEN__, which both bridges rejected, and rejected silently: no crash, no error, the panel's buttons just toggled their own labels while nothing reached the page.

• ToolsSheet now injects window.__RC_TOKEN__ into the panel WebView at document-start.
• panel.js reads it, and shows a visible warning banner if it's ever missing instead of silently doing nothing.
• Both bridges now log token rejections to logcat.

Installs as an update over v1.0.0 (same signing key, versionCode 2).

Still not verified on real hardware from the build box — please report anything else that misbehaves.