feat(api): add message injection endpoint

[dathtd119]

Summary

• Adds POST /api/inject endpoint for external systems to inject messages into claudeclaw sessions via HTTP
• Bearer token authentication via apiToken field in settings.json
• Extends json() helper to support HTTP status codes

Use Case

Allows n8n workflows (or any external system) to programmatically send messages to a running claudeclaw daemon, replacing the need for a separate hook API.

Configuration

Add to settings.json:

{
  "apiToken": "your-secret-token-here"
}

API

curl -X POST http://127.0.0.1:4632/api/inject \
  -H "Authorization: Bearer your-secret-token-here" \
  -H "Content-Type: application/json" \
  -d '{"message": "Hello from external system"}'

Response: { "ok": true, "result": "...", "exitCode": 0 }

Files Changed

• src/config.ts — apiToken field in Settings
• src/ui/http.ts — json() now accepts optional status code
• src/ui/auth.ts — Bearer token validation (new)
• src/ui/server.ts — POST /api/inject handler

Test plan

• POST without token → 401 Unauthorized
• POST with wrong token → 401 Unauthorized
• POST with valid token, no message → 400 Bad Request
• POST with valid token + message → 200 + assistant response
• No apiToken in settings → 503 Service Unavailable