feat(acp): Route A follow-ups — token usage, opt-in headless auth, status tests + bridge-auth learning