fix(macos): check config file mode for gateway token/password resolution

[kkarimi]

Summary

• Fixes token/password resolution to check config file's gateway.mode directly
• Prevents wrong token path being used when UserDefaults is out of sync with config file

Closes #1021

Changes

The GatewayEndpointStore.Deps.live token and password closures now check the config file's gateway.mode value directly, in addition to CommandResolver.connectionModeIsRemote() (which reads from UserDefaults).

This ensures that when the config file has gateway.mode = "remote", the app will correctly read from gateway.remote.token even if UserDefaults hasn't been synchronized.

let configMode = (root["gateway"] as? [String: Any])?["mode"] as? String
let isRemote = configMode?.lowercased() == "remote" || CommandResolver.connectionModeIsRemote()

Test plan

• Build succeeds (swift build --package-path apps/macos)
• Configure remote mode in config file with remote token
• Verify "Test remote" connects successfully
• Verify local mode still works when configured

🤖 Generated with Claude Code

[steipete]

Updated branch to landable state (rebased onto current main, dropped unrelated oxfmt-only noise).

• Added shared ConnectionModeResolver so config gateway.mode (and gateway.remote.url heuristic) drives mode consistently.
• macOS: token/password resolution now uses resolver; warns (once) when CLAWDBOT_GATEWAY_TOKEN/PASSWORD env overrides config.
• CLI doctor: warns on macOS launchctl getenv overrides; docs + changelog updated.

Local gate:

• pnpm lint && pnpm format && pnpm build && pnpm test
• swift build --package-path apps/macos && swift test --package-path apps/macos

Commits: 15b64eb, c46dfc8

[steipete]

Merged via squash.

Merge commit: 25ae5f8

Thanks @kkarimi!