Release 2.7.3.1: harden proxy recovery, updates and local API.

Restore orphaned system proxy after crash, require update SHA-256, add macOS /api auth token, fix UDP ping false positives, HTTPS-only subscriptions, and keep the UI responsive during connect.

Co-authored-by: Cursor <cursoragent@cursor.com>

internal/update/update_windows.go

@@ -10,6 +10,7 @@ import (
 	"os/exec"
 	"path/filepath"
 	"strconv"
+	"strings"
 	"syscall"
 	"time"
 
@@ -73,6 +74,11 @@ func MaybeFinishUpdate(args []string) bool {
 	self, _ = filepath.Abs(self)
 	target, _ = filepath.Abs(target)
 
+	// Only allow replacing Navis.exe in the same directory as this pending updater.
+	if !safeUpdateTarget(self, target) {
+		return true
+	}
+
 	waitPIDExit(uint32(pid), 120*time.Second)
 	time.Sleep(400 * time.Millisecond)
 
@@ -93,6 +99,16 @@ func MaybeFinishUpdate(args []string) bool {
 	return true
 }
 
+func safeUpdateTarget(self, target string) bool {
+	selfDir := filepath.Clean(filepath.Dir(self))
+	targetDir := filepath.Clean(filepath.Dir(target))
+	if selfDir != targetDir {
+		return false
+	}
+	base := strings.ToLower(filepath.Base(target))
+	return base == "navis.exe"
+}
+
 // CleanupStaleDownloads removes leftover update temps from failed/old runs.
 func CleanupStaleDownloads() {
 	exe, err := os.Executable()