Control handshake: connect to local and remote cores through tw-link (P2)

[fylorn]

Rebased onto dev (after #180 and #182).

What changes

• Core pins: every core crate (tw-api, tw-types, tw-yaml, tw-guard, tw-watch, and the new tw-link) on tag = "v0.47.0"; tw-api.ts regenerated (CONTROL_API_VERSION 20).
• v0.46.0 transition removed: core-sync branch in keys.rs rotate_key; scan_alert / clients_changed cases in src/types.ts; control.key_bind_failed translation. tw-scan watch tests now require a received signal (Ok(Some(()))), not just "not timed out".
• Local mode: the per-launch token is gone (token.rs, the Bearer header, TW_CONTROL_TOKEN). ControlClient reads listen.control.key from the local config.yaml on every connection and runs the Noise handshake on the unix socket / Windows loopback. A missing config or key counts as "core not ready yet"; after WrongKey the key is read once more (rotation). The supervisor no longer passes anything to core.
• Remote mode: connector::handshake uses tw_link::connect; LinkError maps onto ConnectError (Unreachable / Closed / WrongKey / VersionMismatch / Timeout); NotYetAvailable is removed. The mismatch page shows the server core's own version (peer_version) and the app's required version (taken from the locked tw-api version; the control-protocol numbers are added when both version strings are equal, as with unreleased builds).
• Gateway address in remote mode: the host this computer dialled for the control port + the gateway's port; gateway_reachable only as a fallback.
• Regenerated tw-api.ts (CONTROL_API_VERSION 19); zh translations for config.control_key_missing, config.control_key_invalid, control.control_key_locked, control.remote.* (3) and config.remote_port_zero / config.remote_port_is_gateway / config.bad_remote_allow_from; control.unauthorized removed.
• Fixes found while verifying the real app: Settings stays usable while a remote is disconnected (only the sections that edit the server's config go read-only); no "This Mac · Stopped" flash in the sidebar before the connection list loads; menubar_preview --dump prints the native NSMenu including submenus.

Verified

• cargo fmt/clippy/test, pnpm typecheck/build/test with the v0.47.0 twcore release binary (fetch-core.sh); end-to-end re-run on v0.47.0: remote enable → test connection → save and switch → back to local.
• Integration tests against a real core: right key, wrong key, writes, event stream, and twcore control-key --rotate (next connection gets in with the new key, the old key is refused).
• Isolated real app instance (own THINKWATCH_HOME, own ports), driven through its webview:
  • local mode over the handshake; key rotated while the app runs — the event stream reconnects by itself;
  • remote: a core with twcore remote enable --allow 127.0.0.1/32: test OK, wrong key, denied source (dialled via the LAN address → "closed by the server"), save and switch (local core stops), server killed and restarted mid-session (banner, read-only, one notification, recovers and clears it), key rotated on the server → wrong key → key replaced in the edit dialog → reconnects, version mismatch against a P1-era core (page ⑥ with both versions);
  • launch guard: two unfinished launches → picker window first, picking a remote connects it;
  • keys file: connection-keys.json is 0600; deleting the connection removes the entry;
  • native menubar "Connection" submenu (checked current item, separator, "Manage Connections…") via --dump.
• Not verifiable here: holding ⌥ at launch (synthetic key events need Accessibility permission, which this machine doesn't grant) — needs a manual check.

CI

Pins are on the v0.47.0 tag, whose release has all twcore assets, so fetch-core.sh resolves on every platform.

🤖 Generated with Claude Code