fix(cli+web): claudemesh rename via inline-JWT route (v1.19.1)

The /api/my/meshes/:slug PATCH route was never implemented and
better-auth's enforceAuth middleware can't validate the CLI's
device-code JWT (signed with CLI_SYNC_SECRET, not a better-auth
session). Adds /api/cli/meshes/:slug on the web app — verifies
the HS256 JWT inline, scopes the rename to (slug, ownerUserId).
CLI now calls the new path. Mirrors the cli-sync-token pattern.

Closes the "API error 401: Unauthorized" hit after a successful
claudemesh login.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/cli/src/services/api/my.ts

@@ -20,8 +20,11 @@ export async function createMesh(
 }
 
 export async function renameMesh(token: string, slug: string, newName: string) {
+  // Routed through /api/cli/* (not /api/my/*) because the CLI JWT
+  // can't authenticate against the better-auth-protected myRouter.
+  // The /api/cli/meshes/:slug route validates the JWT inline.
   return request<{ slug: string; name: string }>({
-    path: `/api/my/meshes/${slug}`,
+    path: `/api/cli/meshes/${slug}`,
     method: "PATCH",
     body: { name: newName },
     token,