fix(server): play-mode busy-state, auth-token rotation 401, dropped rapid clicks, and background responsiveness

[Daliys]

Summary

Started as an auth-token / domain-reload / app-nap fix. While hardening the
real-time integration test suite that exercises this server, the suite surfaced
three additional server bugs that this PR now also fixes. All three are
verified against a live editor (Unity 6000.4.3f1) and covered by tests.

Fixes in this PR

1. Auth token resolution & background responsiveness (original scope)

• Resolve the auth token from Library/NexusUnityAuthToken.txt with a sane
  fallback, and enable Application.runInBackground + AppNapBypass in
  Init() so the server stays responsive when Unity is backgrounded.

2. isPlayModeTransition never cleared during play mode

IsPlayModeTransitionCached used EditorApplication.isPlayingOrWillChange- Playmode, which stays true for the entire play session, not just the
transition. Consequences while the game was running:

• get_server_status reported busyReason: play_mode_transition the whole time
• acceptsWriteCommands was false for all of play mode
• initialize() threw "editor is busy" until you left play mode

Fixed by treating a transition as "in progress" only while
isPlayingOrWillChangePlaymode != isPlaying. Verified in play mode:
busyReason: idle, writes accepted, initialize() succeeds. Play-mode entry
detection dropped ~90s → ~4.5s.

3. Auth token rotates on domain reload → permanent HTTP 401

The Python bridge (nexus_bridge/_transport.py) resolved the token once at
import. Unity rewrites the token file on every domain reload, so after the
first script compile every authenticated method returned 401 for the rest of
the session — while get_server_status kept returning 200 (it is
auth-exempt), which reads to a client as "the editor never came back". The
401 was even reported as "Unity Server unreachable", misdirecting debugging.

Fixed: re-read the token file and retry once on 401 (first attempt keeps the
import-time token), and report a 401 as an auth failure, not as unreachable.
apply_code_change on multiple files went from a 90s timeout → ~8.6s.
New test_transport cases pin the retry and the error message.

4. Rapid clicks silently dropped

simulate_mouse / click_object_in_game defer the button release ~100ms so
the press is held for a frame. A second click issued inside that window queued
its press while the button was still down — no press edge, so it was silently
lost with no error. Fixed by flushing any pending release before starting a
new click. Reproduced: at 0ms gap the second click vanished; at ≥150ms both
landed.

Testing

• Package unit tests (Editor/tests/) pass, including the new 401-retry cases.
• The pre-push live smoke against the running server passes.
• These fixes were found and verified by a rebuilt real-time integration suite
  (11 suites / 345 named checks) that lives in the consuming project repo. That
  suite is not part of this package PR; it is tracked separately. Highlights
  of what it exposed and now guards against are the three server bugs above.

Closes #71