feat: AI task API, token-based context windows, SSH password auth, sudo bypass detection

Replace message-count context windows with token-budget based ones for both
studio and shell. Add /api/ai/task endpoint for background tool
check/install/update. Enhance sudo blocking to catch piped/chained elevation
commands. Add SSH password support via sshpass and connection editing UI.
Remove realTokens persistence in favor of consumption tracking. Bump to 0.4.1.

💘 Generated with Crush

Assisted-by: GLM-5.1 via Crush <crush@charm.land>

web/src/i18n/en.js

@@ -120,6 +120,8 @@ const en = {
     port: 'Port',
     user: 'User',
     keyPath: 'SSH key path',
+    password: 'Password',
+    passwordHint: 'requires sshpass installed',
     connect: 'Connect',
     save: 'Save',
     cancel: 'Cancel',