fix(server): startup robustness — watchdog false-kill + anonymous collection fetch

[Clydingus]

Two startup-path fixes, split out from the macOS work for an isolated review. Fixes #138 indirectly.

1. Parent watchdog false-kills the server on launch

The parent-death watchdog compared the launcher-supplied --parent-start-time (Electron's Date.now()/1000 - process.uptime()) against psutil's create_time() with a 1s tolerance. On a heavy Electron process, uptime() only starts counting after Chromium/V8 boot, so that estimate lands ~1–3s after the kernel's real create_time — past the tolerance. The server decided its (alive) parent was gone and os._exit(1)'d at startup ("Parent process is already gone, shutting down").

Fix: capture the recycling baseline from psutil at construction, so the startup check and every poll use one source. The launcher value is still accepted but no longer used for the comparison. PID-recycling protection is preserved — a recycled PID has a different create_time.

2. Model picker degrades when a restricted HF token is cached

The curated Overworld/waypoint collection is public, but the listing inherited the host's cached HF token. A fine-grained / upload-scoped token authenticates yet lacks "read collections", so it 403s and the picker silently falls back to the default model alone.

Fix: fetch the collection with token=False (forced anonymous) — public curated metadata shouldn't depend on ambient credentials.