feat: v1.0 — am serve : API HTTP + WebSocket authentifiée pour piloter am à distance (closes #80)

- src/serve.rs : tiny_http (zéro dépendance runtime) — token Bearer obligatoire (comptime-ish), rate limiting fenêtre 60s par IP, routes réutilisant les contrats --json (stats/sessions/ps/providers/run/start/stop/ask) en re-spawnant le binaire (pattern web #54), WebSocket RFC 6455 (handshake 101 + accept sha1, broadcast des events du journal par polling 500ms, première passe = indexation), TLS délégué au reverse proxy (documenté)
- am serve --token <TOKEN> [--host] [--port 8080] [--rate-limit 120] + REPL + help + man
- 9 tests : auth (sans/mauvais/bon token), routes (runner mocké), run args, 404, rate limit, handshake RFC 6455 (vecteur connu), broadcast journal, comparaison token
- E2E réel : curl 401/health/stats + POST run exécutant un agent, client WS brut recevant l'event run en temps réel
- version 1.0.0 (milestone v1.0 terminé) ; test version_table suit Cargo.toml (major plus hardcodé)

src/repl.rs

@@ -122,6 +122,7 @@ const COMMAND_DESCRIPTIONS: &[(&str, &str)] = &[
     ("playbook", "replay a saved history sequence step by step (am history --save)"),
     ("lab", "benchmark the same task on several agents (duration, cost, --json)"),
     ("web", "local read-only web dashboard with charts (issue #54)"),
+    ("serve", "authenticated HTTP + WebSocket API to drive am remotely (issue #80)"),
     ("plugins", "list the event plugins and test one (JSON contract on stdin/stdout)"),
     ("shell", "show or switch the system shell"),
     ("theme", "show or switch the color theme"),
@@ -238,7 +239,7 @@ impl AmCompleter {
                 "self-update", "self-uninstall", "export", "import", "shell", "theme", "lang",
                 "tip", "dashboard", "favorite", "unfavorite", "note", "tag", "untag", "tags",
                 "profile", "man", "models", "catalog", "providers", "suggest", "ask", "registry", "audit",
-                "service", "schedule", "monitor", "web", "sync", "migrate", "playbook", "lab", "plugins",
+                "service", "schedule", "monitor", "web", "serve", "sync", "migrate", "playbook", "lab", "plugins",
                 "ls", "dir", "cd", "ps", "where", "get", "help", "version", "exit",
             ],
             config_sub: vec!["show", "path", "edit", "validate", "add"],
@@ -780,6 +781,7 @@ pub fn banner_box(
     }));
     rows.push(inner("  catalog    list · status · search · info · init".to_string()));
     rows.push(inner("  registry   publish · search · install · list".to_string()));
+    rows.push(inner("  serve      API HTTP+WS · token · stats · run · start · stop · ask".to_string()));
     rows.push(inner(
         "  activity   sessions · stats · top · report · projects · timeline · log · logs · history"
             .to_string(),
@@ -1677,6 +1679,12 @@ fn handle_line(
             port: opt_value("--port").and_then(|v| v.parse().ok()),
             no_open: flag("--no-open"),
         }),
+        "serve" => Command::Serve(crate::cli::ServeArgs {
+            token: opt_value("--token"),
+            host: opt_value("--host"),
+            port: opt_value("--port").and_then(|v| v.parse().ok()),
+            rate_limit: opt_value("--rate-limit").and_then(|v| v.parse().ok()),
+        }),
         "sync" => Command::Sync {
             message: opt_value("--message"),
         },