feat: add mosaic gateway CLI commands and admin token auth

Gateway daemon lifecycle management via the Mosaic CLI:
- install, start, stop, restart, status, config, logs, uninstall
- Admin API token auth (Bearer tokens) alongside existing session auth
- Bootstrap endpoint for first-user setup (POST /api/bootstrap/setup)
- admin_tokens table in DB schema with SHA-256 hashed tokens
- Gateway .env fallback loading from ~/.config/mosaic/gateway/.env
- CLI daemon management with PID file, log tailing, health checks

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

apps/gateway/src/main.ts

@@ -1,5 +1,12 @@
 import { config } from 'dotenv';
-import { resolve } from 'node:path';
+import { existsSync } from 'node:fs';
+import { resolve, join } from 'node:path';
+import { homedir } from 'node:os';
+
+// Load .env from daemon config dir (global install / daemon mode).
+// Loaded first so monorepo .env can override for local dev.
+const daemonEnv = join(homedir(), '.config', 'mosaic', 'gateway', '.env');
+if (existsSync(daemonEnv)) config({ path: daemonEnv });
 
 // Load .env from monorepo root (cwd is apps/gateway when run via pnpm filter)
 config({ path: resolve(process.cwd(), '../../.env') });