feat(keys): import API keys into TF CLI from the Keys page

[hsn8086]

Summary

• Supersedes closed, unmerged PR feat(keys): import API keys into TF CLI from the Keys page #1955 to adopt the #tfcli= URL fragment namespace before initial release. The companion tf-cli implementation is ed4df86, with the namespace finalized in 2548c36. There is deliberately no legacy #tf= parser because the integration has not shipped.
• Adds an "Import to TF CLI" action to the Keys page row menu, matching the CCS upload icon.
• Communicates directly from the browser to the local tf process on exact loopback ports 43110 through 43119. The TokenRouter backend provides no import or authorization endpoint, and keys never transit the TokenRouter backend.
• Accepts /keys#tfcli=1.<port>.<secret> session links. The router removes every #tfcli= fragment immediately before auth redirects, and valid sessions remain in module memory for up to 10 minutes.
• Standard keys include group_id and group_name; composite keys omit single source group fields.
• HTTP 202 Accepted indicates only that the terminal accepted the request; key validation, optional naming, gateway probing, and local persistence take place subsequently within tf.

Security and compatibility

• CSP connect-src explicitly permits http://127.0.0.1:43110 through http://127.0.0.1:43119, with no wildcard ports or LAN expansion.
• Optional challenge/HMAC proof only demonstrates possession of the current tf session secret and request integrity. It provides no page, key, local binary, or gateway authentication, freshness guarantee, or replay protection.
• Unverified compatibility remains available for loopback /ping and /import, requiring an explicit browser warning and a second confirmation. Terminal confirmation is mandatory in all paths.

Validation

• tf-cli: make check, go test -race ./..., PTY tests (9/9), and cross-compilation across five targets passed.
• TokenRouter frontend: targeted fragment, HMAC, and router tests (14/14); full frontend suite (317 files, 2234 tests); ESLint; vue-tsc; and production build passed.
• TokenRouter backend: go test ./... passed on the final feature baseline; the fragment rename itself added no backend changes.
• GitHub CI: backend security, frontend, frontend security, golangci-lint, shell, and backend test passed for 6c60a01e5.
• git diff --check and forbidden-path checks passed.
• Real browser and current tf checks confirmed #tfcli= generation and immediate URL removal, the proof header, an empty Referer, terminal confirmation, truthful HTTP 202 UI state, exit 0, and isolated 0600 credential persistence.