Release 2.7.3.1: harden proxy recovery, updates and local API.

Restore orphaned system proxy after crash, require update SHA-256, add macOS /api auth token, fix UDP ping false positives, HTTPS-only subscriptions, and keep the UI responsive during connect.

Co-authored-by: Cursor <cursoragent@cursor.com>

internal/appui/index.html

@@ -740,7 +740,7 @@
       <div class="brand-wrap">
         <div class="brand-row">
           <h1 class="brand">Navis</h1>
-          <span class="badge-ver" id="badgeVer">2.7.2</span>
+          <span class="badge-ver" id="badgeVer">2.7.3</span>
         </div>
         <p class="tagline">Быстрый клиент · Naive · Hy2 · AWG · Xray</p>
       </div>
@@ -915,11 +915,14 @@
       if (typeof window.getState === "function") return;
       window.__navisHttp = true;
       async function call(name, args) {
+        const headers = { "Content-Type": "application/json" };
+        if (window.__NAVIS_TOKEN__) headers["X-Navis-Token"] = window.__NAVIS_TOKEN__;
         const r = await fetch("/api/" + name, {
           method: "POST",
-          headers: { "Content-Type": "application/json" },
+          headers: headers,
           body: JSON.stringify({ args: args || [] })
         });
+        if (r.status === 401) throw "unauthorized";
         const j = await r.json();
         if (j && j.error) throw j.error;
         return j ? j.result : null;
@@ -1489,9 +1492,7 @@
     (async () => {
       try {
         await refresh({ syncForm: true });
-        if (profiles.length > 1 && autoBest.checked && !connected) {
-          await withBusy(async () => { await runBest(true); });
-        }
+        // Auto-best connect is opt-in via checkbox only — never on first paint.
       } catch (e) {
         setMeta(String(e), "err");
       }