v0.2.4: Add bearer token auth to API endpoints exposed via tunnel

The tool API (POST /api/tool, /api/bash) was publicly accessible
through Cloudflare Tunnel with zero authentication — anyone who
discovered the URL could execute arbitrary commands.

- Add requireAuth middleware checking Authorization: Bearer <token>
- Use a single 24-char session password for both VNC and API auth
- Agent loop sends vncPassword as bearer token in all API requests
- /api/health and /api/info remain unauthenticated (needed for
  health checks and tunnel URL discovery)
- Skip auth when no password is set (backward compat for local use)