feat: plan-approval overlay, auth-expiry handling, cert download, login reset

- Add a dedicated plan-approval bottom sheet (interactive-prompt) driven by
  ExitPlanMode's now-4-option layout (Claude Code v2.1.177), with
  approve/YOLO/reject/feedback wired through respondPlan(requestId).
- PermissionManager: stop auto-expiring AskUserQuestion/plan prompts and stop
  releasing pending prompts on client disconnect — they reflect real CLI
  state and must survive reconnects.
- Detect server-rejected tokens (401/403 or failed WS handshake) and bounce
  back to the login screen via a new AUTH_EXPIRED_EVENT.
- Add `/cert` endpoint + Settings entry so phones can download/trust the
  self-signed HTTPS cert directly; fix cert IP detection on non-macOS hosts.
- Add `clawtap reset-login` command and `/api/auth/reset-attempts` endpoint
  to clear login rate-limit lockouts.
- Codex adapter: only forward recognized keystrokes/option indices to tmux,
  never the synthetic "deny" dismissal signal.
- PWA: actively poll for service-worker updates (iOS standalone apps don't
  reliably check on navigation).
- update-service.sh: install tmux if missing, prompt to create the env file
  instead of failing, add --skip-firewall, and improve logging.

server/adapters/codex/codex-tmux-adapter.ts

@@ -616,8 +616,13 @@ export class CodexTmuxAdapter extends EventEmitter {
     if (!session) return;
 
     if (selectedOption != null) {
-      // Codex uses single-key shortcuts (y, a, p, d, n)
-      tmuxManager.sendKeys(session.windowId, selectedOption, false).catch(() => {});
+      // Codex uses single-key shortcuts (y, a, p, d, n) or numbered options.
+      // The overlay also sends 'deny' as a generic close/dismiss signal —
+      // that is NOT a Codex keystroke and must never be typed into the CLI
+      // (it would literally type the word "deny" into the terminal).
+      if (/^[yandp]$/i.test(selectedOption) || /^\d+$/.test(selectedOption)) {
+        tmuxManager.sendKeys(session.windowId, selectedOption, false).catch(() => {});
+      }
     }
     if (textValue != null) {
       tmuxManager.sendKeys(session.windowId, textValue, true).catch(() => {});