feat: plan-approval overlay, auth-expiry handling, cert download, login reset

- Add a dedicated plan-approval bottom sheet (interactive-prompt) driven by
  ExitPlanMode's now-4-option layout (Claude Code v2.1.177), with
  approve/YOLO/reject/feedback wired through respondPlan(requestId).
- PermissionManager: stop auto-expiring AskUserQuestion/plan prompts and stop
  releasing pending prompts on client disconnect — they reflect real CLI
  state and must survive reconnects.
- Detect server-rejected tokens (401/403 or failed WS handshake) and bounce
  back to the login screen via a new AUTH_EXPIRED_EVENT.
- Add `/cert` endpoint + Settings entry so phones can download/trust the
  self-signed HTTPS cert directly; fix cert IP detection on non-macOS hosts.
- Add `clawtap reset-login` command and `/api/auth/reset-attempts` endpoint
  to clear login rate-limit lockouts.
- Codex adapter: only forward recognized keystrokes/option indices to tmux,
  never the synthetic "deny" dismissal signal.
- PWA: actively poll for service-worker updates (iOS standalone apps don't
  reliably check on navigation).
- update-service.sh: install tmux if missing, prompt to create the env file
  instead of failing, add --skip-firewall, and improve logging.

server/adapters/claude/index.ts

@@ -64,7 +64,7 @@ export class ClaudeAdapter extends IAdapter {
     const events: string[] = [
       'streaming-text', 'thinking', 'tool-start', 'tool-done',
       'tool-updates', 'new-messages', 'session-idle',
-      'permission-request', 'ask-question', 'mode-changed',
+      'permission-request', 'ask-question', 'interactive-prompt', 'mode-changed',
       'session-ended', 'session-error', 'compacting', 'compact-done',
       'processing-started',
     ];
@@ -192,7 +192,7 @@ export class ClaudeAdapter extends IAdapter {
   async attachSession(sid: string, cwd: string, options?: QueryOptions): Promise<{ sessionId: string }> { return this._tmux.attachSession(sid, cwd, options); }
   async destroySession(sid: string): Promise<void> { return this._tmux.destroySession(sid); }
   async sendMessage(sid: string, text: string, options?: QueryOptions): Promise<void> { return this._tmux.sendMessage(sid, text, options); }
-  async respondPlan(sid: string, optionIndex: number, text?: string): Promise<void> { return this._tmux.respondPlan(sid, optionIndex, text); }
+  async respondPlan(sid: string, optionIndex: number, text?: string, requestId?: string): Promise<void> { return this._tmux.respondPlan(sid, optionIndex, text, requestId); }
   async switchModel(sid: string, model: string): Promise<void> { return this._tmux.switchModel(sid, model); }
   async interrupt(sid: string): Promise<void> { return this._tmux.interrupt(sid); }
   flushMessages(sid: string): void { this._tmux.flushMessages(sid); }