fix: support authenticated Busy Bar Wi-Fi connections

[unipheas]

Summary

• Authenticate local Wi-Fi requests with the Busy Bar HTTP API password and documented X-API-Token header.
• Distinguish rejected credentials from unreachable devices and repair secure-field layout/focus behavior.
• Normalize pasted device URLs across API and web-interface actions.
• Keep local builds on the distributed Developer ID identity, with working development/ad-hoc fallbacks.
• Update app, CLI, MCP, and README guidance for local passwords versus cloud API tokens.
• Bump BarKeep to 1.0.13.

Verification

• 24 Swift tests pass with 0 failures.
• Release build succeeds.
• Shell and Homebrew Ruby syntax checks pass.
• Real Busy Bar Wi-Fi authentication verified against firmware 1.0.2 / API 24.3.0.
• No credentials are present in the diff.

Review

• Pre-landing review: 1 issue found and fixed (typed HTTP status handling).
• Independent adversarial review: 2 issues found and fixed (certificate fallback and pasted-URL web link).
• Codex CLI review unavailable because its locally installed native binary is missing; independent agent review completed instead.

Documentation

• README: distinguishes the local Wi-Fi HTTP API password from cloud API tokens, documents BARKEEP_TOKEN, and links the official local API guide.