security: use bootstrap key in manifest, add .tmp cache cleanup

- manifest.webmanifest/+server.ts: swap PUBLIC_AE_API_SECRET_KEY →
  PUBLIC_AE_BOOTSTRAP_KEY (least privilege; endpoint only needs a
  site-domain lookup, same as the bootstrap use case)
- electron_relay.ts: add cleanup_tmp_files() — runs `find ... -name
  "*.tmp" -mmin +N -delete` via native run_cmd bridge
- launcher_background_sync.svelte: call cleanup_tmp_files() on mount
  when is_native && cache_root are present (once per startup)
- AE__Permissions_and_Security.md: close Sev-1 audit language
- TODO__Agents.md: mark PUBLIC_AE_API_SECRET_KEY audit as complete

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/lib/electron/electron_relay.ts

@@ -54,6 +54,18 @@ export async function run_cmd_sync({ cmd, return_stdout = true }: { cmd: string,
   return await native.run_cmd_sync({ cmd, return_stdout });
 }
 
+/**
+ * Stale .tmp Cleanup
+ * Deletes in-progress download artifacts (*.tmp) older than max_age_minutes from the cache root.
+ * Called at launcher startup to prevent cache directory bloat from interrupted downloads.
+ * Default: 1440 minutes = 24 hours.
+ */
+export async function cleanup_tmp_files({ cache_root, max_age_minutes = 1440 }: { cache_root: string, max_age_minutes?: number }) {
+    if (!native) return { success: false, error: 'Native bridge not available' };
+    const cmd = `find "${cache_root}" -name "*.tmp" -mmin +${max_age_minutes} -type f -delete`;
+    return await native.run_cmd({ cmd, timeout: 30000, return_stdout: false });
+}
+
 export async function run_osascript(script: string) {
   if (!native) return { success: false, error: 'Native bridge not available' };
   return await native.run_osascript(script);

src/routes/events/[event_id]/(launcher)/launcher_background_sync.svelte

@@ -10,6 +10,7 @@
     import { ae_util } from '$lib/ae_utils/ae_utils';
     import { db_events } from '$lib/ae_events/db_events';
     import * as native from '$lib/electron/electron_relay';
+    const { cleanup_tmp_files } = native;
 
     let { log_lvl = 1 } = $props();
 
@@ -106,6 +107,15 @@
         setTimeout(() => refresh_session_data(), 1000);
         setTimeout(() => refresh_presentation_data(), 3000);
         setTimeout(() => refresh_presenter_data(), 5000);
+
+        // Clean up stale .tmp files (interrupted downloads) older than 24h.
+        // Run once at startup — sufficient for conference day usage.
+        const cache_root = $ae_loc.local_file_cache_path;
+        if ($ae_loc.is_native && cache_root) {
+            cleanup_tmp_files({ cache_root }).then((result) => {
+                if (log_lvl) console.log('Sync: .tmp cleanup complete.', result);
+            });
+        }
     });
 
     onDestroy(() => {

src/routes/manifest.webmanifest/+server.ts

@@ -19,7 +19,8 @@ export const GET: RequestHandler = async ({ url, fetch }) => {
     const api_cfg = {
         base_url: api_base_url,
         headers: {
-            'x-aether-api-key': public_env.PUBLIC_AE_API_SECRET_KEY,
+            // Bootstrap key: limited-permission key for unauthenticated domain lookups (least privilege)
+            'x-aether-api-key': public_env.PUBLIC_AE_BOOTSTRAP_KEY,
             'x-no-account-id': public_env.PUBLIC_AE_NO_ACCOUNT_ID
         },
         fetch