feat(#83): Phase 6 — runtime reconnect + status polling + security + docs

[ajianaz]

Closes #83

Summary

Phase 6 of the Remote Connection Manager — runtime reconnect (no restart),
live status polling, security polish, and docs.

Changes

Backend (src-tauri/)

• reconnect_connection(id) — new command. Rebuilds the live uteke_client
  from a connection config (local -> ensure_uteke_server, remote -> skip spawn),
  swaps AppState.uteke_client in place, then health-checks and updates status.
• set_primary_connection now live-swaps the active backend immediately
  (previously DB-only — switching primary required a restart).
• rebuild_active_client() helper — shared by both commands.
• Security:
  • DB file perms set to 0600 on startup (Unix) — db holds auth tokens.
  • store::clear_token() wipes auth_token to NULL before delete
    (prevents forensic recovery from freed sqlite pages).
  • mask_token_log() redacts tokens in all log output.
• ensure_uteke_server made pub(crate) so the helper can spawn locally.

Frontend (src/lib/)

• stores/connections.svelte.ts — new reactive store. Periodic health polling:
  primary every 15s, all connections every 60s. Status badges stay fresh when a
  server goes up/down without the user clicking "Test".
• ConnectionManager.svelte — wired to the store; added Reconnect button
  per card; onDestroy stops polling.
• ipc.ts — connection.reconnect(id) wrapper.

Docs

• .agent.md — new Connection layer (Phase 6+) rule section.
• CHANGELOG.md — entry under ## [0.2.0] — Unreleased.

Acceptance (from #83)

• Switch backends without restart — set_primary / reconnect rebuild live.
• Status stays fresh when server goes up/down — polling store.
• Tokens never leak in logs — mask_token_log.
• DB file perms confirmed 600 on startup.
• Token cleared on delete — clear_token before row removal.
• Docs updated (.agent.md, CHANGELOG.md).

Validation

• cargo fmt + cargo clippy --all-targets -- -D warnings — clean
• npm run build — clean