fix(gui): restore iCloud Keychain autofill for admin token dialog

[yansigit]

Summary

• Restore iCloud Keychain autofill for the dashboard admin-token dialog on Safari/WebKit.
• Keep token handling memory-only; this does not add browser storage or change the server authentication boundary.

Verification

• bun x tsc --noEmit
• bun test ./gui/tests/admin-token-dialog.test.ts — 4 passed
• bun run check:hygiene
• bun scripts/privacy-scan.ts
• GitHub Actions cross-platform CI — passed
• Screenshot waived: this changes password-manager compatibility without changing the rendered interface.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Added/updated tests for behavior changes under src/ or gui/src/, or obtained test-exception-approved (check: bun run check:hygiene).
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Security review found no change to token persistence or exposure: the token remains memory-only, no web storage or cookie path was added, and the existing XSS-storage guard remains covered by tests.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[github-actions]

PR automation (bot-owned)

• Class: same-repo-human (same-repo-human)
• Base: ef68b967c31ebdf20a7e770f8ed2dde628c7b12e
• Head: 88e0b1a3f263d1a54eb5afedf4d7eb4042b36c99
• Action: observed
• Exact-head gate: BLOCKED (not-mergeable, check-missing)
• Sensitive paths: none
• Maintainer auto-merge approval: NO
• Bot merge evidence: NO
• Next action: wait for exact-head checks

[github-actions]

✅ READY

• all PR quality gates passed.

UI screenshot waived by the gui-screenshot-waived label.

Hygiene

✅ Deterministic PR hygiene checks passed.

[yansigit]

Owner-authorized merge: required CI is green and the authentication/token-handling security review found no persistence or exposure regression. Using the fork-owner ruleset bypass because the author cannot approve their own PR.