Replace ngrok with Tailscale device sharing and plan native iOS control

[kovtcharov]

Claudia's remote browser routing forced unfamiliar hosts onto plain HTTP/WS port 4001, and its built-in remote-access flow depended on ngrok. This replaces that flow with operator-managed Tailscale Serve: devices open one private HTTPS address and authenticate to the existing host session.

Changes

• Remove the ngrok manager, tunnel APIs/WS status/CLI commands, hostname detection, legacy tunnel cookies/tokens, QR dependency, and obsolete mobile terminal page.
• Add Devices setup with a saved Tailscale address, credential-free address copying, and host-identity checks. Validate browser login, recover from API authentication failures, scope credentials per backend, scrub query tokens, and support logout.
• Preserve HTTPS/ports for REST and WSS; accept bearer headers on native WebSocket upgrades. Protect local-only routes from proxy requests and restrict forwarded-scheme trust to loopback. Add opt-in loopback binding without changing default ports.
• Add test-cli --remote-status and prevent explicitly configured Electron remote connections from silently spawning a different local session.
• Document setup/migration and a native iOS plan focused on remote workspace, GitHub, and task management. iOS implementation is a follow-on.

Validation

• Production backend/frontend/Electron build passes.
• Backend, frontend, shared, and Electron tests pass; per-file coverage thresholds and the repository coverage ratchet pass.
• Real-backend Serve-shaped HTTP/WS tests cover missing/invalid credentials, native bearer upgrades, Secure cookies, local-bootstrap/Jira rejection, host identity, removed tunnel APIs, and logout. Existing task viewer tests pass.
• Chromium against an isolated HTTPS proxy: rejected-token recovery, successful login/WSS, desktop and phone layouts, logout. No page errors; no token in the address bar; auth cookie absent after logout.
• test-cli --remote-status succeeds against an isolated backend on a nondefault port.

Desktop setup screenshot · Phone setup screenshot

Remaining validation and limits

Draft pending a real physical-device tailnet test: Tailscale 1.102.4 is installed on the development host but reports NeedsLogin. The HTTPS proxy test verifies application behavior, not VPN reachability. Before merge, verify phone cellular + Tailscale, simultaneous task viewing, reconnect, and denial from an unauthorized device.

The existing instance token grants full host control; per-device revocation remains follow-on work. Task terminals use the existing viewer ownership model; the separate workspace shell still has shared resize semantics. Existing ngrok processes must be stopped through their original launcher during migration; this change does not kill unrelated processes or enable Tailscale on the developer's machine.

Refs #178, #189, #204, #222. Native iOS follow-on plan: docs/plans/claudia-ios-remote-control.md.