feat: AI intent router live + TOTP repeat-auth fix

AI Intent Router:
- Wired /api/v1/ai/intent and /api/v1/ai/capabilities into app.js
- Pattern matching works offline, no API key needed
- Handles: deploy, recommend, diagnose, backup, health, list
- AI chat floating button on dashboard (🤖)
- Suggestion chips: Deploy Plex, Stream movies, Block ads, System health
- Deploy buttons in chat launch the app selector

TOTP Fix:
- secureFetch() was missing credentials: same-origin
- Session cookie was not being sent on API calls
- Added credentials: same-origin to all fetch calls
- Users no longer prompted for TOTP on every action

Nesting Guard:
- Fixed logging module path (../utils/logging not ./logging)
- Switched to console.log to avoid module export mismatch

MCP Server:
- 551-line JSON-RPC server ready at src/mcp/mcp-server.js
- Configurable via DASHCADDY_URL + DASHCADDY_API_KEY env vars

status/js/globals.js

@@ -197,6 +197,7 @@ async function secureFetch(url, options = {}) {
     options = { ...options, signal: AbortSignal.timeout(15000) };
   }
 
+  options.credentials = options.credentials || 'same-origin';
   const response = await fetch(url, options);
 
   // Auto-retry once on CSRF failure (token may have been rotated by TOTP re-auth)