Secure and bound the reader runtime

[dlpwaters]

Summary

• require authentication for every reader API and rotate the one-time launch capability into an HttpOnly session cookie
• remove tokens and filesystem paths from browser payloads; cap writable state, scans, shell output, HTTP work, and EPUB archive expansion
• tie the loopback server to the exact Qt reader and stop both on close, widget unload, checkout change, or removal
• serialize and validate conversions and reject symlinked, ambiguous, encrypted, or structurally unsafe EPUB inputs

Verification

• 32 Python unit/integration tests pass
• Python, JavaScript, QML, manifest, plugin, checksum, ZIP, diff, path, and secret checks pass
• real Qt WebEngine smoke: four-book library, two-page layout, navigation, page-turn toggle, Paper/Sepia/Night themes, zero browser errors
• anonymous and stale launch sessions return 403; authenticated bootstrap exposes no token or filesystem fields
• closing the live Qt window terminates both reader and loopback server

Marketplace follow-up: omacom/omarchy-plugin-marketplace#1393