v5.1.1 — QA defect remediation (WS routing/auth, TUI chat render, CLI parity, nexa shim)

What's Fixed (QA defect remediation)

User-facing fixes from the v5.0.3 QA pass (GLM-2 + independent verification):

CLI

• openforge update / openforge rollback no longer crash with NameError (read-only safe handlers added).
• openforge doctor now actually runs the self-health report (previously printed the help banner). Removed the duplicate doctor definition.

Gateway / Web

• /ws/terminal and /ws/approval WebSocket handlers are now correctly typed (: WebSocket), fixing the FastAPI 403 rejection that blocked the Web UI terminal.
• /ws/approval now enforces token auth when FORGE_REQUIRE_AUTH=1 (matches /ws/terminal).
• /api/sandbox/build timeout is clamped to terminal_tool.MAX_TIMEOUT (was 180s > 60s cap -> ValueError).

TUI

• Chat panel actually renders again (the layout never updated the chat region).
• /exit and /quit work (previously advertised but not wired).
• Skills panel no longer NameErrors when a skill is disabled (missing ERROR import).
• Persona detail toggle no longer crashes (detail_open field added).

Agent

• LLMProvider.chat_stream now yields an ("error", ...) tuple on missing credentials instead of raising.

Compat

• Restored the legacy nexa import shim (re-exports openforge with a DeprecationWarning). The mandate is honored; older integrations keep working.

Upgrade

• git pull && pip install -e . (or use the installer) — then openforge doctor.
• No breaking changes. No data migration required.

Rollback

• git checkout v5.1.0 / pip install the previous checkout. No DB or schema changes in this release.

Test status

• Python suite: 1127 passed, 13 skipped (llama.cpp E2E gate + POSIX-only), 0 failed (Windows + Linux env-crosschecked).