Fix local storage token authorization

[Nathan (hydraxman)]

Summary

• reject fabricated LOCAL storage tokens and enforce issued token permissions, expiry, and file scope
• generate an unpredictable center token by default and strictly parse Bearer authorization headers
• prevent traversal in storage file resolution and screenshot token issuance
• preserve compatibility for agents that cannot refresh write tokens during rolling deployment

Testing

• ./gradlew.bat :common:test :center:test --no-daemon --console=plain
• Added regression coverage for arbitrary tokens, read/write permissions, file scope, expiry, Bearer parsing, traversal, screenshot scope, and agent token compatibility