refactor(web): secure Pico websocket access behind launcher auth

[wj-xiao]

📝 Description

This change hardens the Pico launcher integration so the browser no longer receives the raw Pico WebSocket token.

It adds a non-secret /api/pico/info endpoint for launcher UI metadata, proxies /pico/ws through the launcher with dashboard auth and same-origin checks, and injects the upstream Pico WebSocket subprotocol server-side. The frontend chat flow is updated to connect to the launcher proxy directly, and the related docs/tests are refreshed.

🗣️ Type of Change

• 🐞 Bug fix (non-breaking change which fixes an issue)
• ✨ New feature (non-breaking change which adds functionality)
• 📖 Documentation update
• ⚡ Code refactoring (no functional changes, no api changes)

🤖 AI Code Generation

• 🤖 Fully AI-generated (100% AI, 0% Human)
• 🛠️ Mostly AI-generated (AI draft, Human verified/modified)
• 👨‍💻 Mostly Human-written (Human lead, AI assisted or none)

🔗 Related Issue

N/A

📚 Technical Context (Skip for Docs)

• Reference URL: N/A
• Reasoning: The launcher UI previously exposed the raw Pico WebSocket token to the browser and relied on the client to replay it in the WebSocket subprotocol. This change keeps the token server-side, returns only non-secret Pico metadata to the frontend, and requires launcher auth plus same-origin validation before proxying /pico/ws upstream.

🧪 Test Environment

• Hardware: Apple Silicon MacBook Pro
• OS: macOS 26.4.1
• Model/Provider: Not exercised (launcher dashboard and Pico gateway path only)
• Channels: Pico

📸 Evidence (Optional)

Click to view Logs/Screenshots

go test ./web/backend/api ./web/backend/middleware
ok  	github.com/sipeed/picoclaw/web/backend/api	(cached)
ok  	github.com/sipeed/picoclaw/web/backend/middleware	(cached)

pnpm lint
pnpm build

☑️ Checklist

• My code/docs follow the style of this project.
• I have performed a self-review of my own changes.
• I have updated the documentation accordingly.

[CLAassistant]

All committers have signed the CLA.