feat: v1.0 — am serve : API HTTP + WebSocket authentifiée pour piloter am à distance (closes #80)

- src/serve.rs : tiny_http (zéro dépendance runtime) — token Bearer obligatoire (comptime-ish), rate limiting fenêtre 60s par IP, routes réutilisant les contrats --json (stats/sessions/ps/providers/run/start/stop/ask) en re-spawnant le binaire (pattern web #54), WebSocket RFC 6455 (handshake 101 + accept sha1, broadcast des events du journal par polling 500ms, première passe = indexation), TLS délégué au reverse proxy (documenté)
- am serve --token <TOKEN> [--host] [--port 8080] [--rate-limit 120] + REPL + help + man
- 9 tests : auth (sans/mauvais/bon token), routes (runner mocké), run args, 404, rate limit, handshake RFC 6455 (vecteur connu), broadcast journal, comparaison token
- E2E réel : curl 401/health/stats + POST run exécutant un agent, client WS brut recevant l'event run en temps réel
- version 1.0.0 (milestone v1.0 terminé) ; test version_table suit Cargo.toml (major plus hardcodé)

src/cli.rs

@@ -291,6 +291,8 @@ pub enum Command {
     },
     /// Local read-only web dashboard with charts (issue #54)
     Web(WebArgs),
+    /// Authenticated HTTP + WebSocket API to drive am remotely (issue #80)
+    Serve(ServeArgs),
     /// Push the state into the configured git repository (issue #66)
     Sync {
         /// Commit message (default: "am sync — state update")
@@ -698,6 +700,23 @@ pub struct WebArgs {
     pub no_open: bool,
 }
 
+/// Arguments of am serve (issue #80).
+#[derive(Args, Debug, Clone, Default)]
+pub struct ServeArgs {
+    /// Bearer token required on every request (mandatory)
+    #[arg(long, value_name = "TOKEN")]
+    pub token: Option<String>,
+    /// Listen address (default 127.0.0.1)
+    #[arg(long, value_name = "HOST")]
+    pub host: Option<String>,
+    /// Listening port (default 8080)
+    #[arg(long, value_name = "PORT")]
+    pub port: Option<u16>,
+    /// Per-IP request budget per minute (default 120)
+    #[arg(long, value_name = "N")]
+    pub rate_limit: Option<u32>,
+}
+
 /// Remote catalog subcommands (issues #60 #67).
 #[derive(Subcommand, Debug, Clone)]
 pub enum CatalogCmd {