feat(FN-2517): add remote access controls across dashboard and TUI

- Add project-scoped remote settings and control APIs for provider activation, tunnel lifecycle, token generation, URL, and QR retrieval
- Extend Settings modal with a dedicated Remote Access section, provider forms, status/actions, and coverage in SettingsModal tests
- Wire dashboard TUI settings state to remote configuration/status and add interactive remote shortcuts for start/stop/token/url/qr actions
- Document remote-access behavior in architecture, CLI, and settings references and include a patch changeset for @runfusion/fusion

docs/cli-reference.md

@@ -76,15 +76,15 @@ fn dashboard --dev
 ### Interactive Terminal UI (TTY Mode)
 
 When running in an interactive terminal (TTY), `fn dashboard` starts an
-interactive TUI with five sections:
+interactive TUI with sectioned views for system status, logs, settings, and
+remote-access controls.
 
-| Section | Description |
-|---|---|
-| **System** | Host, port, URL, auth mode, token, engine status, uptime |
-| **Logs** | Real-time log entries with timestamps and severity levels |
-| **Utilities** | Actions: refresh stats, clear logs, toggle engine pause |
-| **Stats** | Task counts by column, active task count, agent state counts |
-| **Settings** | Key settings from the task store |
+Remote view/actions support:
+- Switching active provider (`tailscale` / `cloudflare`)
+- Manual tunnel lifecycle (`start` / `stop`)
+- Persistent token regeneration
+- Short-lived token URL generation (bounded TTL)
+- QR hand-off (always includes the full authenticated URL)
 
 On startup, the TUI opens on the **System** section by default so you can
 immediately see host/port and access-token details.
@@ -204,6 +204,11 @@ fn serve --interactive
 | `--interactive` | Interactive port selection. |
 | `--daemon` | Enable bearer token authentication for CLI client connections. |
 
+`fn serve` uses the same project-scoped Remote Access manager as `fn dashboard`.
+When remote access is enabled/configured, the headless server exposes `/api/remote/*`
+control/status endpoints and applies the same hybrid token validation rules for
+remote routes (persistent token + optional short-lived token registry).
+
 ---
 
 ## `fn daemon`