fix(dashboard-api): prefer gateway.auth.token over stale env token (DocPanel 401)

[webdevtodayjason]

Real fix for Bug #3 (the config reconcile in the earlier work did NOT hold — the stale token lives in the gateway LaunchAgent plist, regenerated on deploy, not in ~/.argentos/.env).

Root cause (verified live)

resolveDashboardApiToken resolved env DASHBOARD_API_TOKEN first. That env value is sourced from the gateway plist/service-env and had drifted stale (48-char token) vs. the api-server's accepted set. The api-server always accepts gateway.auth.token (resolved live per-request), but the gateway sent the stale plist token → every DocPanel save (workflow output node) returned HTTP 401 Invalid token. Direct curl proved it: gateway.auth.token → 200, plist env token → 401. A fresh run (87f13e5f) still 401'd after the env reconcile, confirming the env var wasn't the controllable source.

Fix

Prefer gateway.auth.token (the one value both gateway and api-server always agree on, read live) over the env var; fall back to env only when argent.json has no gateway token. Still per-request (INV-1/INV-4 green). Only affects gateway→api-server server-side calls (doc_panel, workflow output); the dashboard browser authenticates separately.

Tests

src/utils/dashboard-api.test.ts updated for the new precedence (10 cases incl. config-wins, env-fallback, trim, null, no-cache). tsgo 189 (unchanged); oxfmt clean; INV checks pass.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 8ceb2a13-222f-43fb-8a58-51b71d0bba86

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/docpanel-token-prefer-config

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}