Add local IPC API and resilient API client

[Tylerpro09]

What changed

• Added a versioned, line-delimited JSON IPC API for tunnel management, account state, agent claiming, and service updates.
• Added the IPC data models, client helpers, daemon handlers, and security documentation.
• Added transient API request retries and clearer error propagation for unexpected API failures.
• Documented the local API in the README and docs/ipc-api.md.

Why

Automation, dashboards, and MCP-style integrations need a stable local control surface without exposing the agent secret. The API client also needs to tolerate transient network failures and report non-successful API responses clearly.

Impact

Local clients can query status and tunnels, create or delete tunnels, inspect account state, and start claim provisioning over the existing local IPC transport. Unix socket permissions and the restricted Windows named-pipe ACL remain the access-control boundary.

Validation

• cargo fmt --check
• cargo check --workspace
• cargo test --workspace --no-fail-fast

[nglmercer]

#195