Protect cloud agent task routes and model cooldown management endpoints
with management-session auth and consistent CORS handling.
Also align cloud agent API serialization with the dashboard, reuse the
provider connection schema for CLI key storage, and accept active OAuth
tokens when building virtual auto-combo candidates.
Hide admin password entry during setup, make doctor degrade to warnings
when source-only runtime checks are unavailable, and improve stop
behavior by attempting graceful shutdown before force killing ports.
Also use SQLite's backup API for safer snapshots under WAL, align CLI
key writes with the current provider_connections schema, and include
follow-on compatibility fixes for GLM provider detection, stream error
sanitization, and auth-aware test coverage.
