Show fresh authenticated agent connection status

[Timverhoogt]

Changes

• Persistent textual header badge for authenticated, fresh Hermes/OpenClaw readiness, independent of robot power/privacy.
• Bounded single-flight background probes, selected-backend and selected-model checks, stale-result expiry, configuration-change invalidation, and safe diagnostic text.
• Badge opens Settings with keyboard focus and an explicit retry action; child-locked status hides adult connection details and blocks retry.
• Coordinated PWA shell bump to v66 and mobile/desktop styling.
• Backend and intercepted-API Chromium coverage for authentication failures, freshness, reconnection, navigation/retry, safe text and layout.
• Keep notification dismissal assertions on a frozen clock; screenshots must not consume success notifications' reading lifetime.

Verification

• 43 focused tests passed, including eight actual Chromium tests (three connection tests and five notification tests).
• Ruff, JavaScript syntax checks and git diff whitespace checks passed.
• Phone preview visually inspected: badge is legible with no wordmark overlap.
• Broad local suite runs timed out on this Python 3.14 host; do not count those as passing. Require the existing full Python 3.11/3.12 CI matrix before merging.

Health checks perform no speech, camera capture or robot movement.