fix(cli+dashboard): restore API-key auth flow

[Jungley8]

Summary

close #51

Included fixes

• CLI test scope fix for parse_api_key_from_config_toml.
• Dashboard auth fix for API-key-protected mode:
  • Network/Budget panel requests now use OpenFangAPI (injects Bearer header).
  • Auth token bootstrap from URL query (?token= / ?api_key=) into session storage.
• Remove generated desktop schema artifact from VCS and ignore generated desktop dir.

Problem addressed

With api_key enabled, dashboard had partial 401 behavior because some panel calls used raw fetch('/api/...') without auth header. This patch normalizes those calls through the shared API client.

Validation

• Targeted Rust tests for config TOML API-key parser pass.
• Static dashboard code scan confirms API calls are routed through OpenFangAPI wrapper.

Notes

A previous PR from the same branch was closed; this is a fresh reopen request with current branch state.