Expose hosted CLI downloads

[TKlerx]

Summary

• add authenticated starterctl download metadata, artifact, and checksum routes
• show CLI download controls on Settings > Tokens
• mount CLI release artifacts into the app container and add a critical mutation test runner

Verification

• pnpm vitest run tests/unit/cli-release-service.test.ts
• pnpm run test:mutation:critical
• pnpm run typecheck
• pnpm run lint
• pnpm run check:text
• git diff --check --cached