feat: plan-approval overlay, auth-expiry handling, cert download, login reset

- Add a dedicated plan-approval bottom sheet (interactive-prompt) driven by
  ExitPlanMode's now-4-option layout (Claude Code v2.1.177), with
  approve/YOLO/reject/feedback wired through respondPlan(requestId).
- PermissionManager: stop auto-expiring AskUserQuestion/plan prompts and stop
  releasing pending prompts on client disconnect — they reflect real CLI
  state and must survive reconnects.
- Detect server-rejected tokens (401/403 or failed WS handshake) and bounce
  back to the login screen via a new AUTH_EXPIRED_EVENT.
- Add `/cert` endpoint + Settings entry so phones can download/trust the
  self-signed HTTPS cert directly; fix cert IP detection on non-macOS hosts.
- Add `clawtap reset-login` command and `/api/auth/reset-attempts` endpoint
  to clear login rate-limit lockouts.
- Codex adapter: only forward recognized keystrokes/option indices to tmux,
  never the synthetic "deny" dismissal signal.
- PWA: actively poll for service-worker updates (iOS standalone apps don't
  reliably check on navigation).
- update-service.sh: install tmux if missing, prompt to create the env file
  instead of failing, add --skip-firewall, and improve logging.

server/ws-types.ts

@@ -49,13 +49,16 @@ export type WsType = typeof WS[keyof typeof WS];
 
 /**
  * CLI plan approval selector option indices (ExitPlanMode).
- * Claude Code v2.1.x shows 3 options:
- *   0: "Yes, auto-accept edits"         → BYPASS
- *   1: "Yes, manually approve edits"    → MANUALLY_APPROVE
- *   2: "Type here to tell Claude what to change" → TEXT_FEEDBACK
+ * Claude Code v2.1.177 shows 4 options:
+ *   0: "Yes, and bypass permissions"               → BYPASS
+ *   1: "Yes, manually approve edits"                → MANUALLY_APPROVE
+ *   2: "No, refine with Ultraplan on Claude Code on the web"
+ *   3: "Tell Claude what to change"                 → TEXT_FEEDBACK
+ * _selectOption clamps to the last option when overshooting, so
+ * TEXT_FEEDBACK also lands correctly on older 3-option layouts.
  */
 export const PLAN_OPTION = {
   BYPASS: 0,
   MANUALLY_APPROVE: 1,
-  TEXT_FEEDBACK: 2,
+  TEXT_FEEDBACK: 3,
 } as const;