feat: make Named Cloudflare Tunnel the default public API path

[Aiweline]

Summary

• make Named Tunnel the default public-access mode with SSE support and no implicit Quick Tunnel fallback
• add an API-page setup wizard for temporary scoped Cloudflare API Token provisioning or an existing Tunnel runner token/install command
• create the remotely managed Tunnel, protected ingress, proxied DNS CNAME, and runner token through the Cloudflare API
• store only the runner token in a fixed local 0600 credential file; keep the Cloudflare API Token out of config, responses, logs, and command arguments
• add fingerprint validation, fail-closed startup, setup/enable concurrency guards, local and Cloudflare rollback, safe credential rotation, and explicit replacement confirmation
• keep Quick Tunnel as an explicit development-only mode without SSE
• document the flow in English and Chinese and localize the UI in English, Chinese, German, Korean, and Russian

Cloudflare permissions

Automatic setup needs only:

• Account / Cloudflare Tunnel / Edit
• Zone / DNS / Edit

This follows the official Cloudflare Tunnel API setup guide.

Validation

• npm run typecheck
• GUI ESLint and production build
• 61/61 targeted Cloudflare tunnel, API, security, provisioning, setup, and UI tests after rebasing onto dev
• local browser smoke test on the API page
• full suite before the dev rebase: 3409 passed, 5 failed
• current dev-based server-auth run: 53 passed, the same 5 provider-management tests failed; those 5 failures also reproduce unchanged on release base commit 304a1ea

Test limitation

No real Cloudflare account credential was available for a live external provisioning test. Cloudflare request/rollback behavior is covered with injected API responses, and the local service is running with the final UI for manual verification.

[github-actions]

✅ Target branch corrected

This pull request now targets dev.

The [WRONG BRANCH] title prefix has been removed. The pull request has been marked ready for review again.