b69df75f0c
The /api/my/meshes/:slug PATCH route was never implemented and better-auth's enforceAuth middleware can't validate the CLI's device-code JWT (signed with CLI_SYNC_SECRET, not a better-auth session). Adds /api/cli/meshes/:slug on the web app — verifies the HS256 JWT inline, scopes the rename to (slug, ownerUserId). CLI now calls the new path. Mirrors the cli-sync-token pattern. Closes the "API error 401: Unauthorized" hit after a successful claudemesh login. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>