feat: plan-approval overlay, auth-expiry handling, cert download, login reset

- Add a dedicated plan-approval bottom sheet (interactive-prompt) driven by
  ExitPlanMode's now-4-option layout (Claude Code v2.1.177), with
  approve/YOLO/reject/feedback wired through respondPlan(requestId).
- PermissionManager: stop auto-expiring AskUserQuestion/plan prompts and stop
  releasing pending prompts on client disconnect — they reflect real CLI
  state and must survive reconnects.
- Detect server-rejected tokens (401/403 or failed WS handshake) and bounce
  back to the login screen via a new AUTH_EXPIRED_EVENT.
- Add `/cert` endpoint + Settings entry so phones can download/trust the
  self-signed HTTPS cert directly; fix cert IP detection on non-macOS hosts.
- Add `clawtap reset-login` command and `/api/auth/reset-attempts` endpoint
  to clear login rate-limit lockouts.
- Codex adapter: only forward recognized keystrokes/option indices to tmux,
  never the synthetic "deny" dismissal signal.
- PWA: actively poll for service-worker updates (iOS standalone apps don't
  reliably check on navigation).
- update-service.sh: install tmux if missing, prompt to create the env file
  instead of failing, add --skip-firewall, and improve logging.

src/App.tsx

@@ -1,6 +1,6 @@
 import { useState, useCallback, useEffect, useRef } from 'react';
 import { STORAGE } from './lib/storage-keys';
-import { isAuthenticated, clearToken } from './lib/api';
+import { isAuthenticated, clearToken, AUTH_EXPIRED_EVENT } from './lib/api';
 import { usePushNotifications } from './hooks/usePushNotifications';
 import { LoginView } from './components/LoginView';
 import { SessionsView } from './components/SessionsView';
@@ -89,6 +89,13 @@ export function App() {
     setAuthed(false);
   }, []);
 
+  // Server rejected our token (expired/invalid) — drop back to login
+  useEffect(() => {
+    const handler = () => handleLogout();
+    window.addEventListener(AUTH_EXPIRED_EVENT, handler);
+    return () => window.removeEventListener(AUTH_EXPIRED_EVENT, handler);
+  }, [handleLogout]);
+
   const openChat = useCallback((sessionId?: string, cwd?: string, adapter?: string) => {
     if (!sessionId && cwd) {
       const v: View = { name: 'newchat', cwd };
@@ -130,6 +137,28 @@ export function App() {
     return () => navigator.serviceWorker.removeEventListener('controllerchange', handleControllerChange);
   }, []);
 
+  // PWA: actively poll for service worker updates.
+  // iOS standalone PWAs don't reliably perform the browser's normal
+  // "check sw.js for byte changes on navigation" — without this, an
+  // installed app can stay on a stale bundle indefinitely. Forcing
+  // registration.update() on focus/interval triggers that check.
+  useEffect(() => {
+    if (!navigator.serviceWorker) return;
+    const checkForUpdate = () => {
+      navigator.serviceWorker.getRegistration().then(reg => reg?.update()).catch(() => {});
+    };
+    const handleVisibility = () => {
+      if (document.visibilityState === 'visible') checkForUpdate();
+    };
+    checkForUpdate();
+    document.addEventListener('visibilitychange', handleVisibility);
+    const interval = setInterval(checkForUpdate, 60 * 60 * 1000);
+    return () => {
+      document.removeEventListener('visibilitychange', handleVisibility);
+      clearInterval(interval);
+    };
+  }, []);
+
   // PWA iOS: Sync --app-height CSS variable to the true viewport height.
   // WebKit bug: after a keyboard open/close cycle, viewport-fit=cover's layout
   // extension is lost, causing 100dvh to shrink permanently. We track the max