feat: v1.0 — am serve : API HTTP + WebSocket authentifiée pour piloter am à distance (closes #80)

- src/serve.rs : tiny_http (zéro dépendance runtime) — token Bearer obligatoire (comptime-ish), rate limiting fenêtre 60s par IP, routes réutilisant les contrats --json (stats/sessions/ps/providers/run/start/stop/ask) en re-spawnant le binaire (pattern web #54), WebSocket RFC 6455 (handshake 101 + accept sha1, broadcast des events du journal par polling 500ms, première passe = indexation), TLS délégué au reverse proxy (documenté)
- am serve --token <TOKEN> [--host] [--port 8080] [--rate-limit 120] + REPL + help + man
- 9 tests : auth (sans/mauvais/bon token), routes (runner mocké), run args, 404, rate limit, handshake RFC 6455 (vecteur connu), broadcast journal, comparaison token
- E2E réel : curl 401/health/stats + POST run exécutant un agent, client WS brut recevant l'event run en temps réel
- version 1.0.0 (milestone v1.0 terminé) ; test version_table suit Cargo.toml (major plus hardcodé)

man/am-serve.1

@@ -0,0 +1,25 @@
+.ie \n(.g .ds Aq \(aq
+.el .ds Aq '
+.TH am-serve 1  "serve " 
+.SH NAME
+serve \- Authenticated HTTP + WebSocket API to drive am remotely (issue #80)
+.SH SYNOPSIS
+\fBserve\fR [\fB\-\-token\fR] [\fB\-\-host\fR] [\fB\-\-port\fR] [\fB\-\-rate\-limit\fR] [\fB\-h\fR|\fB\-\-help\fR] 
+.SH DESCRIPTION
+Authenticated HTTP + WebSocket API to drive am remotely (issue #80)
+.SH OPTIONS
+.TP
+\fB\-\-token\fR \fI<TOKEN>\fR
+Bearer token required on every request (mandatory)
+.TP
+\fB\-\-host\fR \fI<HOST>\fR
+Listen address (default 127.0.0.1)
+.TP
+\fB\-\-port\fR \fI<PORT>\fR
+Listening port (default 8080)
+.TP
+\fB\-\-rate\-limit\fR \fI<N>\fR
+Per\-IP request budget per minute (default 120)
+.TP
+\fB\-h\fR, \fB\-\-help\fR
+Print help

man/am.1

@@ -1,6 +1,6 @@
 .ie \n(.g .ds Aq \(aq
 .el .ds Aq '
-.TH am 1  "am 0.7.0" 
+.TH am 1  "am 1.0.0" 
 .SH NAME
 am \- agent\-manager (am) — manage local AI coding agents
 .SH SYNOPSIS
@@ -157,6 +157,9 @@ Real\-time monitor of the managed processes (issue #50)
 am\-web(1)
 Local read\-only web dashboard with charts (issue #54)
 .TP
+am\-serve(1)
+Authenticated HTTP + WebSocket API to drive am remotely (issue #80)
+.TP
 am\-sync(1)
 Push the state into the configured git repository (issue #66)
 .TP
@@ -241,4 +244,4 @@ Export the configuration and installation state (backup)
 am\-import(1)
 Import a previously exported configuration and state
 .SH VERSION
-v0.7.0
+v1.0.0