feat: AI intent router live + TOTP repeat-auth fix

AI Intent Router:
- Wired /api/v1/ai/intent and /api/v1/ai/capabilities into app.js
- Pattern matching works offline, no API key needed
- Handles: deploy, recommend, diagnose, backup, health, list
- AI chat floating button on dashboard (🤖)
- Suggestion chips: Deploy Plex, Stream movies, Block ads, System health
- Deploy buttons in chat launch the app selector

TOTP Fix:
- secureFetch() was missing credentials: same-origin
- Session cookie was not being sent on API calls
- Added credentials: same-origin to all fetch calls
- Users no longer prompted for TOTP on every action

Nesting Guard:
- Fixed logging module path (../utils/logging not ./logging)
- Switched to console.log to avoid module export mismatch

MCP Server:
- 551-line JSON-RPC server ready at src/mcp/mcp-server.js
- Configurable via DASHCADDY_URL + DASHCADDY_API_KEY env vars

status/index.html

@@ -954,6 +954,7 @@
   <!-- Tailscale device list panel (self-contained, polls /api/v1/tailscale/devices) -->
   <script src="/js/log-insights.js" defer></script>
   <script src="/js/disk-settings.js" defer></script>
+  <script src="/js/ai-chat.js" defer></script>
   <script src="/js/tailscale-devices.js" defer></script>
   <script src="/js/language-selector.js" defer></script>
 
@@ -962,6 +963,8 @@
   <script src="/dist/features.js" defer></script>
   <script src="/dist/onboarding.js" defer></script>
   <script src="/dist/init.js" defer></script>
+  <!-- AI Chat Floating Button -->
+  <button onclick="toggleAIChat()" style="position:fixed;bottom:20px;right:20px;width:56px;height:56px;border-radius:50%;background:linear-gradient(135deg,#6366f1,#8b5cf6);border:none;box-shadow:0 4px 20px rgba(99,102,241,0.4);cursor:pointer;z-index:9998;font-size:1.5rem;display:flex;align-items:center;justify-content:center;transition:transform 0.2s;" onmouseover="this.style.transform='scale(1.1)'" onmouseout="this.style.transform='scale(1)'" title="AI Assistant">🤖</button>
 </body>
 
 </html>