Add API authentication with browser-accessible credential passing

[TimeToBuildBob]

Background

Users report being unable to access the ActivityWatch server from a browser on Android (issue #143). Part of this is expected behavior (server only listens on localhost), but we also want to add API authentication by default on Android.

Goals

Per discussion in #143:

• Add API authentication enabled by default on the Android server
• Compatible clients using aw-client or aw-client-rust should "just work" once they use recent versions
• Users accessing via browser should have a path that works

Proposed Solutions

Option 1: Setting to disable authentication

Add a settings toggle "Require API authentication" (default: on). When turned off, the server accepts unauthenticated requests (useful for trusted local network setups).

Option 2: "Open in browser" link with credentials

Add an "Open in browser" button/link in the Android app that opens the browser with credentials passed along (e.g., via a token in the URL, or by launching a localhost URL that auto-authenticates the session).

Both options are not mutually exclusive — we could implement both.

Related

• Related to aw-tauri: the same authentication approach should apply there too
• Clients using aw-client/aw-client-rust should automatically handle auth
• Issue Unable to import/export settings on Android 13 #101 (related server access issue)
• Context: Exporting and server not working #143 (comment)

Implementation Notes

The server-side authentication would live in aw-server or aw-server-rust. The Android app would need to:

1. Generate/store an API token at first launch
2. Configure the server to require this token
3. Provide UX for users to access the web interface (the "open in browser" approach)

cc @ErikBjare

[TimeToBuildBob]

Cross-Component Auth Design

I've drafted a comprehensive technical design for the auth implementation across all AW components: activitywatch-auth-design.md

Key decisions relevant to Android:

1. Bearer token stored in app-internal storage, auto-generated on first launch
2. "Open in Browser": Passes token via URL param → server sets HttpOnly session cookie → redirects (strips token from URL for security)
3. Settings toggle: "Require API authentication" (default: ON for Android)
4. Config: [auth] section in aw-server-rust config with enabled, token, and exempt_paths fields

Existing WIP in ActivityWatch/aw-server-rust#185 (dev/apikey branch) covers the server-side guard. The remaining work is:

• Complete server middleware (token validation, cookie session for browser)
• Android app UI (settings toggle, "Open in Browser" button)
• aw-client library updates (transparent token handling)

Full discussion in ActivityWatch/activitywatch#1199.