fix(dashboard): support secure loopback auto-auth

[jamesbrink]

Summary

• add opt-in UNDERSTAND_AUTO_AUTH=1 clean-root entry for Vite and the standalone viewer
• preserve bearer-token checks on graph and source endpoints
• reject non-loopback Host headers in auto-auth mode to prevent DNS rebinding
• mark token-bearing redirects Cache-Control: no-store
• document the mode and bump all plugin manifests to 2.9.5

Verification

• pnpm test — 509 passed, 4 skipped
• pnpm lint
• dashboard production build
• standalone viewer production build
• live checks: clean root 302/no-store, unauthenticated endpoint 403, hostile Host 421, authenticated dashboard 200
• independent agent peer review: ship

Compatibility

The feature is opt-in. With UNDERSTAND_AUTO_AUTH unset, the existing explicit tokenized-URL flow and custom-Host behavior remain unchanged.