Sprint 19: Password auth, security headers, login page (Issue NousResearch#23)

…ix (NousResearch#34)

Squash merge of feat/mobile-setup-and-fixes

…legram notification

- _spawn_cc: catch TimeoutExpired, return timed_out=True
- _notify_failure: haiku summarises stdout, sends Telegram via home channel
- _action_address_comments: detect timeout/exit!=0/blocked, call _notify_failure

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

Doc-parity with linxule/hermes-kimi-plugin's NousResearch#34 docstring expansion at
the same init site. Two-path architecture (adapter.send() vs the module-
level send_kimi_message helper) made explicit; when-to-use guidance for
group rooms vs DMs; failure modes when the agent isn't system-prompted to
call send_message_tool.

Comment-only — no runtime behaviour change. Keeps this legacy variant
useful as an inspection ref alongside the standalone plugin.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…d-unit-tests

test: reorganize test structure and add missing unit tests

…d-unit-tests

test: reorganize test structure and add missing unit tests

- path-to-regexp: 0.1.12 → 0.1.13 (CVE-2026-4867, GHSA-37ch-88jc-xwx2)
- picomatch: 2.3.1 → 2.3.2 (CVE-2026-33671, GHSA-c2c7-rcm5-vvqj)
- undici: 7.23.0 → 7.27.1 (CVE-2026-1526/CVE-2026-2229/CVE-2026-1528)
- serialize-javascript: 6.0.2 → 7.0.3 (GHSA-5c6j-r48x-rmvq, via overrides)

Fixes Dependabot alerts NousResearch#37, NousResearch#34, NousResearch#33, NousResearch#32, NousResearch#29, NousResearch#27

…d-unit-tests

test: reorganize test structure and add missing unit tests

…tdin

Deploy NousResearch#34: the lock itself engaged (allow_anon=false, hermes key loaded,
confirmed by the /health dump in the failure diagnostics), but the post-flip
gate probe ran 'docker exec' without -i — the heredoc never reached python3's
stdin, the probe printed nothing, and the empty output failed the LOCK_OK
check, falsely redding an otherwise successful cutover. The wire step already
used -i; the gate now does too, so the 401/keyed-auth probes actually run.

https://claude.ai/code/session_018vp1LDdpoaRLCNZQRsnAp8

…arch#34, NousResearch#65)

- NousResearch#33 GH_TOKEN propagation: _inject_gh_token_into_env runs `gh auth
  token` before each worker subprocess.Popen and injects into env if
  the worker doesn't have GH_TOKEN/GITHUB_TOKEN.
- NousResearch#34 respawn_guarded active_pr exempts review roles (tony/tchalla/
  vision/reviewer). Bounded: exemption only applies while
  consecutive_failures < max_retries; once exhausted the guard fires.
- NousResearch#65 fabricated github-auth block claims rejected:
  FabricatedAuthClaimError raised when kanban_block reason matches
  auth-claim pattern AND dispatcher's `gh auth status` succeeds.
  Strict leading-position regex with cause:/blocker:/reason:/infra:
  prefix exemption.

Context: hermes-jarvis#61. 33 tests pass.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>