fix: registration token moves from install URL to X-Registration-Token header (SEC-002)

A token in the query string leaks to shell history, process lists, and
server access logs. The install endpoint now reads X-Registration-Token;
a query-string token is refused with guidance and is never echoed back
or logged. Server-built and web-UI install commands updated (curl -H,
irm -Headers).

web/src/pages/settings/AgentManagement.tsx

@@ -95,15 +95,17 @@ const AgentManagement: React.FC = () => {
     if (!selectedToken?.token) return '';
     const serverUrl = getServerUrl();
     const token = selectedToken.token;
+    // SEC-002: token travels in the X-Registration-Token header, never the
+    // URL — query strings land in shell history, process lists, and access logs.
     switch (platform.id) {
       case 'linux':
       case 'macos':
-        return `curl -sfL "${serverUrl}${platform.installScript}?token=${token}" | sudo bash`;
+        return `curl -sfL -H "X-Registration-Token: ${token}" "${serverUrl}${platform.installScript}" | sudo bash`;
       case 'windows':
         // irm returns the response body as a string, so the pipe into iex runs
         // the script directly — no temp file, no params (token is baked in at
         // render time). Must be pasted into an elevated PowerShell.
-        return `irm "${serverUrl}${platform.installScript}?token=${token}" | iex`;
+        return `irm "${serverUrl}${platform.installScript}" -Headers @{'X-Registration-Token'='${token}'} | iex`;
       default:
         return '';
     }