Show where to find the login token on the login page

[Hon-Lu]

Summary

Since login became required on loopback (#345), people upgrading from 0.7.x land on the login page with no hint of what to enter. The token lives in a file they have never seen, and the page only says "Use the password or token configured on your server."

When the server uses a generated token, the login page now has a collapsed "Where do I find my token?" disclosure:

• A host command that prints the token, matching the server's platform:
  • Windows: Get-Content "$env:APPDATA\roamgate\auth-token"
  • macOS/Linux: cat ~/.config/roamgate/auth-token
• A Copy button, shown only in a secure context where the clipboard API works (loopback or HTTPS).
• A pointer to roamgate url --qr for signing in from a phone.
• A link to the login options in docs/DEPLOYMENT.md#basic-runtime-configuration (ROAMGATE_PASSWORD and the PIN subsection right after it).

Behavior by mode:

• Fixed password: unchanged, no hint (the user chose the password).
• PIN: the hint stays hidden until the user switches to "Use password or token instead".

Security

The page is unauthenticated, so the command never contains the token, and it names the file relative to $env:APPDATA, $HOME, or ~ so it does not reveal the account name. If the token path is outside those roots, no command is shown. The page does reveal the host OS family and that a generated token (256-bit) is in use.

Notes

• roamgate url --qr needs roamgate on PATH, which is not true for every install (for example the plugin binary), so the file command is the primary instruction.
• The docs link points at main; renaming that heading would only drop the anchor.

Verification

• bun test server/src/http/login-page-pin.test.ts server/src/config/auth-token.test.ts
• bun run lint
• bun run typecheck:quick
• bun run test:quick shows no new failures compared with main on the same machine
• Manually checked in Chrome against a real server: token mode on Windows and Linux commands, PIN mode switching, Copy, and the docs link