feat: AI intent router live + TOTP repeat-auth fix

AI Intent Router:
- Wired /api/v1/ai/intent and /api/v1/ai/capabilities into app.js
- Pattern matching works offline, no API key needed
- Handles: deploy, recommend, diagnose, backup, health, list
- AI chat floating button on dashboard (🤖)
- Suggestion chips: Deploy Plex, Stream movies, Block ads, System health
- Deploy buttons in chat launch the app selector

TOTP Fix:
- secureFetch() was missing credentials: same-origin
- Session cookie was not being sent on API calls
- Added credentials: same-origin to all fetch calls
- Users no longer prompted for TOTP on every action

Nesting Guard:
- Fixed logging module path (../utils/logging not ./logging)
- Switched to console.log to avoid module export mismatch

MCP Server:
- 551-line JSON-RPC server ready at src/mcp/mcp-server.js
- Configurable via DASHCADDY_URL + DASHCADDY_API_KEY env vars

dashcaddy-api/src/app.js

@@ -95,6 +95,7 @@ const workflowsRoutes = require('../routes/workflows');
 const dependenciesRoutes = require('../routes/dependencies');
 const securityRoutes = require('../routes/security');
 const diskSettingsRoutes = require('../routes/disk-settings');
+const aiIntentRoutes = require('../routes/ai-intent');
 const logInsightsRoutes = require('../routes/log-insights');
 const billingRoutes = require('../routes/billing');
 const DependencyManager = require('./managers/dependency-manager');
@@ -759,6 +760,7 @@ async function createApp() {
 
   // Log Insights — plain English activity summary + safe log disposal
   apiRouter.use('/disk-settings', diskSettingsRoutes);
+  apiRouter.use(aiIntentRoutes({ asyncHandler: ctx.asyncHandler }));
   apiRouter.use(logInsightsRoutes({
     asyncHandler: ctx.asyncHandler,
     ok: ctx.ok,