Add one-time AI connection links

[Clearner1]

Summary

• generate a two-minute, one-time AI connection URL from the Basic Auth-protected access page
• let AI clients safely inspect the URL with GET and exchange it once with JSON POST
• reuse the existing 15-minute, 20-call Bearer token and keep OpenAPI limited to three tools
• revoke pending connections together with temporary tokens

Security

• 32-byte random connection codes and tokens are stored only as SHA-256 digests
• GET never consumes or returns a token; POST consumes synchronously before issuing one
• secret responses use Cache-Control: no-store and Referrer-Policy: no-referrer
• no new dependencies, browser storage, CORS, or logging

Verification

• npm run check — 9 test files, 35 tests
• fake-Anki HTTP black-box flow: create, preview, exchange, reject reuse, list decks, revoke
• independent Luna/xhigh/Ponytail security and diff reviews
• Caddy and Cloudflare ingress validation

No Computer Use/E2E and no real Anki card creation were performed.