Generates a deterministic HMAC-SHA256(key=rawMachineId, msg=salt) token
in src/lib/machineToken.ts. The management authz policy now accepts this
token via x-omniroute-cli-token when Host is loopback, letting the local
CLI process call management APIs without requiring a user login session.
`omniroute config token` prints the token for manual use.
Cross-platform system tray for `omniroute --tray`: Windows uses a
PowerShell NotifyIcon script (zero native binary, AV-safe); macOS/Linux
use systray2 lazy-installed at runtime into ~/.omniroute/runtime/.
Includes per-platform autostart (LaunchAgent / .desktop / registry) and
`omniroute config tray <enable|disable>` CLI command.
DISPLAY added to env-sync allowlist as an OS/X11 variable, not an
OmniRoute config variable.
Hide admin password entry during setup, make doctor degrade to warnings
when source-only runtime checks are unavailable, and improve stop
behavior by attempting graceful shutdown before force killing ports.
Also use SQLite's backup API for safer snapshots under WAL, align CLI
key writes with the current provider_connections schema, and include
follow-on compatibility fixes for GLM provider detection, stream error
sanitization, and auth-aware test coverage.
