Add CLI management commands: doctor, url --qr, config, auth and more

[powerfooI]

Summary

Routine operations no longer need hand-edited env files, the web UI or long
docs procedures. All subcommands now go through one dispatcher with
consistent help and exit codes (0 ok, 1 failure, 2 usage). roamgate --help
lists every command; it previously omitted herdr.

New commands, which act on the managed service's environment file and data
directory:

Command	Purpose
roamgate doctor [--offline] [--json]	Checks config, credentials, TLS expiry, service, listener (including a port held by another process), network exposure, Herdr, connections, Web Push and updates, and prints a fix for each problem. Output contains no secrets.
roamgate url [--qr] [--address <host>]	Login URLs plus a terminal QR code for phones; refuses a code only this machine could open.
roamgate config show|get|set|unset|edit|path	Validated, atomic, comment-preserving edits to roamgate.env; --restart; KEY=- reads secrets from stdin.
roamgate auth show|rotate|revoke-sessions	Rotate the generated token or sign out every browser, then restart a running service.
roamgate connections list|test|add|remove|set-default	Same rules as the connection selector; refuses edits while a Roamgate process would overwrite them.
roamgate push test	Send a test notification to every enrolled device (the registry is read only).
roamgate update [--check], roamgate rollback	Same checksum-verified installer as the in-app updater; rollback swaps with roamgate.previous.
roamgate service logs [-f] [-n N]	Journal on Linux, ~/Library/Logs on macOS.
roamgate completion bash|zsh|fish	Generated from the same command registry.

Shared code instead of duplication: the update installer and manifest fetch,
the Web Push registry reader and sender, token rotation, session-secret
revocation, and one private-file writer (now with a directory fsync) are
exported and used by both the server and the CLI. plugin url and the Herdr
panel now use the same URL code as roamgate url, which also fixes them
showing http:// for TLS services.

Other notes:

• New runtime dependency: qrcode-generator@2.0.4 (pinned, zero dependencies,
  MIT). A test checks that the rendered code matches the library's module grid.
• macOS: a LaunchAgent counts as running only when launchctl print reports
  state = running, not just when the job is loaded.
• CLI paths come from the injected runtime's home directory, so tests never
  touch the developer's real ~/.config.

Documentation: new "Command-line management" section in docs/DEPLOYMENT.md
plus pointers from README, FEATURES, logging, Web Push, connections and token
rotation.

Verification

bun run format:check
bun run lint
bun run typecheck
bun test server/src/cli server/src/config   # 414+ tests, all pass
bun run test                                 # serial full suite

In the full suite, every test this branch touches passes. Unrelated timing
tests (server/src/worktree/remove.test.ts,
web/src/components/AssistantPanel.test.ts, worktree hooks) time out
intermittently under test:quick's four workers and pass when run alone.

I also checked every command manually against an isolated HOME and a real
bridge. After auth rotate and a restart, the new token signs in and the
old one redirects to /login. doctor passes against the running bridge,
the connections write guard refuses while it serves, and the zsh and bash
completion scripts parse.

🤖 Generated with Claude Code

[powerfooI]

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-14T16:06:13.775278Z	ac4f947	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ac4f947a58

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".