feat(keys): import API keys into TF CLI from the Keys page

[hsn8086]

Summary

• Adds an "Import to TF CLI" row action on the Keys page, using the same upload icon as the adjacent CCS action, to transfer an API key directly to a local tf CLI instance.
• Connects directly from the browser to http://127.0.0.1:43110-43119. TokenRouter adds no backend import or authentication endpoints, and API keys do not pass through the TokenRouter backend.
• Handles /keys#tf=1.<port>.<secret> sessions initiated by tf login --from-web. Router initialization strips every #tf fragment before auth redirects and retains valid sessions in module memory for 10 minutes.
• Sends group_id and group_name for standard keys, while composite keys omit source group metadata.
• Treats HTTP 202 only as terminal request acceptance; gateway validation, optional local-name selection, protocol probing, and disk persistence happen afterward in tf.
• Pairs with tf-cli commit ed4df86. This branch is based on TokenRouter v0.1.276 (07fc006c3).

Security and compatibility

• Proof boundaries: The optional challenge/HMAC exchange and X-TF-Session-Proof header verify only possession of the active session secret and request payload integrity. They do not authenticate the web page, API key, local binary, gateway results, freshness, or replay resistance.
• Unverified fallback: Missing or invalid session proofs fall back to a compatible unverified flow requiring explicit secondary browser confirmation. Terminal confirmation remains mandatory before tf processes the request.
• Fetch controls: Loopback requests omit credentials and referrers, disable cache and redirects, specify loopback address space, and use one 30-second discovery budget.
• CSP pinning: Default CSP, legacy/custom CSP runtime enhancement, and deploy/config.example.yaml explicitly allow http://127.0.0.1:43110 through http://127.0.0.1:43119 without wildcards.

Validation

• Targeted Vitest: 5 files, 54 tests passed.
• Full frontend Vitest: 317 files, 2234 tests passed.
• ESLint and vue-tsc --noEmit passed.
• pnpm build passed with only existing lottie eval, chunk-size, and mixed static/dynamic import warnings.
• Backend go test ./... passed.
• Project Doc anchors resolved and git diff --check passed.
• Real browser and tf CLI checks covered verified proof headers with an empty Referer, the unverified warning flow, terminal confirmation, HTTP 202 handling, composite metadata omission, responsive desktop/mobile layouts, and isolated 0600 credential persistence.

[hsn8086]

Withdrawing this PR before merge so the web-import URL fragment can use the clearer #tfcli= namespace. I will submit the revised protocol separately after both repositories and their integration tests are updated.