[AnthonyRonning]

Maple Agent already has a foreground CLI proxy, but desktop users cannot configure a localhost API through Settings. This adds a Local API section with enable/disable, port selection, live status, active requests, a copyable base URL, instructions linking to the existing API-key controls, and a keyboard-accessible Learn more link directly beneath the introduction pointing to https://maple.ai/docs/proxy.

The local profile daemon owns the listener even when a paired executor is selected. It binds only 127.0.0.1, requires the caller's Maple bearer key, rejects browser-origin requests, and never borrows the desktop login or saves a fallback key. Existing proxy routes and the foreground CLI remain available.

Lifecycle handling fences pending starts and restores, tracks accepted connections and response bodies, and bounds shutdown across incomplete headers, uploads, request setup, SSE, and slow readers. Logout, store maintenance/reset, and Quit close the service before releasing local ownership. Emergency Stop remains available while locked and stays paused across automatic restores; Off also stays paused if its settings write fails. Status updates are coalesced and reject replies from a previous host connection.

Validation before review:

• Full pinned env -u MAPLE_PORT just ci passed through the complete pre-commit hook: formatting, 9 Git metadata tests, all four Clippy configurations, the warning-denied workspace/all-targets build, every workspace test, and 342 headless ACP/proxy tests. Clearing the runtime port override lets the existing CLI-defaults test check port 8080.

• 29 focused Local API tests passed on the rebased Agent 0.0.9 binary: rendered local/remote selection, real private IPC/listeners, streaming disconnect/teardown, stale starts, redundant restore, failed Off persistence, admission limits, locked controls, and UI state/reconnect ordering.

• Native macOS linked Local workspace: real API keys, models, nonstreaming chat and SSE; missing-key/browser rejection; actual Settings switch and invalid port; actual local listener ownership while connected to a separately configured Iroh executor profile.

• Native Local PR build 0cb56b1: Local Pro login, /v1/models, two JSON completions and one SSE completion through 127.0.0.1:37289; all returned 200, SSE finished with [DONE], and the temporary caller key was revoked afterward.

• Native daemon lifecycle: password conversion, Stop during maintenance, locked restart/unlock, authenticated restore, logout, confirmed store replacement using the normal integrity-check child, and explicit GUI Quit.

• Native link check at b51a3006: the Local API pane exposes Learn more as a keyboard-accessible link, clicking it opens https://maple.ai/docs/proxy in the system browser, and the refreshed Local API remains healthy on its reserved port.

The initial native pairing and destructive lifecycle checks used the feature tree based on 7e664459; the full gate uses the feature reapplied to Agent 0.0.9 at d7848049. The architecture review found no new shutdown path in that base update. The native Iroh check paired two isolated profiles on one Mac using the supported Local loopback mode. Cross-computer operation, native Linux/Windows behavior, and release/signing remain separate from these checks.

Post-merge follow-up: update the Maple Proxy marketing guide's desktop instructions for Agent's Local API pane and caller-supplied API keys. This documentation update does not block this PR.