feat(dashboard): bearer-token auth with browser persistence + MIT license

Pre-release polish. Two related changes bundled because they both land the
project on public-release footing:

Dashboard auth
- fn dashboard now gates the HTTP API + terminal/badge WebSockets behind a
  bearer token by default. Token resolution order: --token flag,
  FUSION_DASHBOARD_TOKEN env, FUSION_DAEMON_TOKEN env (back-compat), or an
  auto-generated fn_<32 hex>. --no-auth disables. The startup banner prints
  a click-to-open URL with ?token=<token> embedded.
- Auth middleware now also accepts fn_token=<token> as a query-string
  fallback so EventSource and WebSocket clients (which can't set custom
  headers) still authenticate.
- setupTerminalWebSocket / setupBadgeWebSocket now refuse unauthenticated
  upgrades with a proper 401 + socket close.
- Frontend: new auth.ts module captures ?token= off the URL into
  localStorage (key fn.authToken), strips it from the visible URL via
  replaceState, and installs a window.fetch wrapper that injects
  Authorization: Bearer <token> on every same-origin /api/* request.
  EventSource/WebSocket URL builders (api.ts, sse-bus.ts, useTerminal,
  useBadgeWebSocket) route through appendTokenQuery().

MIT license
- LICENSE file at repo root.
- license: "MIT" on root package.json and every packages/*/package.json,
  plus description/bugs metadata on the CLI package.

Docs
- docs/cli-reference.md documents --token / --no-auth / FUSION_DASHBOARD_TOKEN
  and the click-to-open auth flow.
- docs/getting-started.md, docs/docker.md, README.md point at the new flow
  and the CLI reference section.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

packages/dashboard/src/server.ts

@@ -44,7 +44,7 @@ import {
 import { ChatManager } from "./chat.js";
 import { stopAllDevServers } from "./dev-server-routes.js";
 import type { SkillsAdapter } from "./skills-adapter.js";
-import { createAuthMiddleware } from "./auth-middleware.js";
+import { createAuthMiddleware, authenticateUpgradeRequest, getDaemonToken } from "./auth-middleware.js";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 
@@ -866,12 +866,25 @@ export function setupTerminalWebSocket(
   // Default terminal service for stale eviction (uses default store's root dir)
   const defaultTerminalService = getTerminalService(store.getRootDir());
 
+  // Resolve the daemon token once so every upgrade picks up the same value.
+  const wsDaemonToken = getDaemonToken(options);
+
   server.on("upgrade", (req, socket, head) => {
     const pathname = new URL(req.url || "", `http://${req.headers.host}`).pathname;
     if (pathname !== "/api/terminal/ws") {
       return;
     }
 
+    // When daemon auth is active, refuse WebSocket upgrades that don't
+    // carry a valid bearer token. The token can come from the Authorization
+    // header (rare for browser WebSocket clients) or the `fn_token` query
+    // param (what our own client uses).
+    if (wsDaemonToken && !authenticateUpgradeRequest(wsDaemonToken, req)) {
+      socket.write("HTTP/1.1 401 Unauthorized\r\nConnection: close\r\n\r\n");
+      socket.destroy();
+      return;
+    }
+
     wss.handleUpgrade(req, socket, head, (upgraded) => {
       wss.emit("connection", upgraded, req);
     });
@@ -1130,12 +1143,22 @@ export function setupBadgeWebSocket(
 
   const wss = new WebSocketServer({ noServer: true });
 
+  // Resolve the daemon token once per server so every upgrade picks up the
+  // same value. See the equivalent block in setupTerminalWebSocket above.
+  const badgeWsDaemonToken = getDaemonToken(options);
+
   server.on("upgrade", (req, socket, head) => {
     const pathname = new URL(req.url || "", `http://${req.headers.host}`).pathname;
     if (pathname !== "/api/ws") {
       return;
     }
 
+    if (badgeWsDaemonToken && !authenticateUpgradeRequest(badgeWsDaemonToken, req)) {
+      socket.write("HTTP/1.1 401 Unauthorized\r\nConnection: close\r\n\r\n");
+      socket.destroy();
+      return;
+    }
+
     wss.handleUpgrade(req, socket, head, (upgraded) => {
       wss.emit("connection", upgraded, req);
     });