Merge remote-tracking branch 'origin/master' into worktree/web-multimodal-image-input

# Conflicts:
#	apps/cli/README.i18n.yaml
#	apps/cli/package.json
#	apps/cli/src/app-cli-entry.ts
#	apps/cli/src/args.ts
#	apps/cli/src/bin.ts
#	apps/cli/src/web.ts
#	apps/cli/tests/args.spec.ts
#	docs/architecture.i18n.yaml
#	docs/config-catalog.md
#	docs/module-graph.md
#	packages/README.i18n.yaml
#	packages/client/connection/README.i18n.yaml
#	packages/client/connection/src/client/api.ts
#	packages/client/connection/src/client/fixture.ts
#	packages/client/connection/src/index.ts
#	packages/client/connection/tests/node-half.spec.ts
#	packages/client/ui-conversation/README.i18n.yaml
#	packages/client/ui-conversation/src/client/chat/ChatView.tsx
#	packages/client/ui-conversation/src/client/skeleton/InputBar.tsx
#	packages/host/apiproxy/src/api/host.schema.ts
#	packages/host/apiproxy/src/index.ts
#	packages/ui/tui/README.i18n.yaml
#	pnpm-lock.yaml

apps/cli/src/args.ts

@@ -43,6 +43,8 @@ interface WebInvocation {
   workspaceRoot?: string
   provider?: string
   model?: string
+  /** Extra authorities for the /api browser-trust fence (`host` or `host:port`); LAN IP literals are derived, not listed here. */
+  trustedHosts?: string[]
 }
 
 /** The resolved `dsh` invocation: exactly one mode. `--help`/`--version`/errors exit inside {@link parseDshArgs}. */
@@ -56,6 +58,7 @@ interface WebOptions {
   workspaceRoot?: string
   provider?: string
   model?: string
+  trustedHost?: string[]
 }
 
 /**
@@ -73,6 +76,7 @@ function resolveWeb(options: WebOptions): WebInvocation {
     ...options.workspaceRoot !== undefined && { workspaceRoot: options.workspaceRoot },
     ...options.provider !== undefined && { provider: options.provider },
     ...options.model !== undefined && { model: options.model },
+    ...options.trustedHost !== undefined && { trustedHosts: options.trustedHost },
   }
 }
 
@@ -126,6 +130,7 @@ export function parseDshArgs(argv: readonly string[], version: string): DshInvoc
     .option('--workspace-root <path>', 'parent directory for name-created workspaces')
     .option('--provider <name>', 'override the host default provider')
     .option('--model <id>', 'override the host default model')
+    .option('--trusted-host <authority...>', 'extra authority the /api browser-trust fence accepts (host or host:port; repeatable)')
     .action((options: WebOptions) => {
       // Commander parses the parent (default-surface) options on either side of
       // the subcommand into `program.opts()`. `web` shares none of them, so a