feat(web-service): allow custom access token with persisted port and localized start errors

- Persist user-supplied access token and last-used port in app_metadata, falling back to defaults when unset
- Atomically guard concurrent starts via compare_exchange with RAII rollback of the running flag
- Wrap token and port persistence in a single SeaORM transaction to prevent partial writes
- Classify bind errors (port in use, permission denied, address unavailable, invalid address) into stable i18n keys
- Localize start-failure messages across all 10 supported languages

src-tauri/src/web/handlers/web_server.rs

@@ -18,6 +18,7 @@ pub async fn get_web_server_status(
 pub struct StartWebServerParams {
     pub port: Option<u16>,
     pub host: Option<String>,
+    pub token: Option<String>,
 }
 
 pub async fn start_web_server(