v0.2.1 — the probe survives reality

What changed

Server fixes, all verified live on a real installation the same evening:

• The probe survives reality. The tokenserver tries every token source and
  falls back on 401/403, so a stale Claude Desktop process token can no longer
  block a fresh keychain login. And it no longer requires an active 5-hour
  session window: between windows the weekly and per-model figures flow on
  their own, while the session field honestly shows a dash.
• Rate limits are handled, not fed. On HTTP 429 the probe stops the cycle
  at once and rests at least ten minutes (honouring Retry-After). Repeated
  failures slow the cadence from 120 s to 480 s, so a dead credential idles at
  six requests an hour instead of sixty.
• The status tells the whole story. claudeProbe preserves the usage
  outcome and appends the fallback result instead of overwriting it, and the
  root endpoint reports rev + startedAt — "the wrong code is running" is
  now one curl, not an evening of process archaeology.
• Firmware: stale alerts stay out of your face. Full-screen alerts now
  require the state change to be under two minutes old after boot too, so
  hours-old waiting states rediscovered after a server outage stay in the
  header. Reaches your device on its next flash.

Known

• The alert's pulse phase draws no motion yet — an actual pulse is gated
  behind the AMOLED review protocol.

Upgrading

git pull, then restart the service:
launchctl kickstart -k gui/$UID/se.torget.tokenserver.
Reflash the board when you want the alert fix on the panel.