native: ClaudiaKit discovery & pairing — NWBrowser + Keychain

[itomek]

Part of #125. Blocked by the scaffold, pairing (backend), and Bonjour (backend).

Problem

The apps must find Macs on the LAN and establish trust without typing IPs or copying tokens.

Outcome

ClaudiaKit discovery + pairing: NWBrowser browses _claudia._tcp, resolves endpoints, drives the PIN pairing flow, stores the device token in the Keychain, and reloads it on launch.

Acceptance criteria

• Discovers a real backend on the LAN and surfaces name/version/auth from TXT + /api/server-info
• PIN pairing round-trip against the backend pairing endpoints → token stored in Keychain, survives relaunch
• Local-network permission denial detected (browser state) → exposed as a distinct state for onboarding UI guidance
• Manual-address fallback (host:port entry) for non-mDNS networks
• Unit tests for pairing state machine; manual verification on device/simulator documented

Scope & expectations

• Where: ClaudiaKit/Sources/Discovery, Pairing
• Constraints: tokens only in Keychain, never UserDefaults; Info.plist keys from the scaffold issue

How to verify

UI + HTTP — screen recording or screenshots of discovery→PIN→paired against a real Mac, plus the pair/complete request/response in backend logs.