FEAT-68: add no-auth dev mode and unread session count endpoint

[shafty023]

Add CL_LOCAL_GATEWAY_NO_AUTH=1 mode that bypasses gateway auth for local development. Guarded by !app.isPackaged so it cannot be enabled in production builds. The exchange endpoint issues a 24h session immediately without challenge verification.

Implement GET /api/engineer/symphony/sessions/unread-count to count sessions with unanswered assistant replies, matching the Next.js route behavior for LocalElectron mode.

[closedloop-ai-stage]

Code Review Summary

Status: Approved

Reviewers: Bug Hunter A, Bug Hunter B, Unified Auditor, Premise Reviewer, Gateway Core Architect

Findings

Severity	Count
Blocking	0
High	0
Medium	4

MEDIUM Issues (consider)

1. [P2] [apps/desktop/src/server/operations/symphony-sessions.ts:100] Unread-count endpoint hardcodes 'chat-history.json', missing provider-specific files — sessions using provider='claude' or 'codex' write to chat-history-claude.json / chat-history-codex.json and will silently report 0 unread.
2. [P2] [apps/desktop/src/server/router.ts:414] No-auth exchange path bypasses loopback-address check — the no-auth early return fires before isLoopbackAddress, allowing any remote address to obtain a session token when CL_LOCAL_GATEWAY_NO_AUTH=1.
3. [P2] [apps/desktop/src/server/router.ts:422] Static literal "no-auth" as fallback sessionToken when sessionStore is absent — no session entry is created, the comment // 24h session is misleading, and the token is non-unique across restarts.
4. [P3] [apps/desktop/src/server/operations/symphony-sessions.ts:107] Missing optional chain on history.messages before .at(-1) — if on-disk JSON has no messages key, the call throws (caught silently, but session is excluded from count).

Validation Stats

• Agent failures: 0
• Cross-file grouped: 0 findings consolidated

Recommendation: Approve — no blocking or high-priority issues. The medium items around no-auth mode (loopback bypass, static fallback token) are worth addressing before this pattern is widened.