[nxtman123]

Ordinary writes previously generated a fresh idempotency key on each invocation, leaving agents to manage safe retries after an ambiguous failure. Agent connection also required keeping a process running while a person approved it.

This change:

• Persists ordinary write fingerprints and keys before sending, reuses keys for identical unresolved requests, and clears them when the command completes. Application uploads retain their key if processing-status lookup fails after acceptance.
• Scopes fingerprints to origin, credential, target, body, and revision. Stores no payloads, uses the existing private config lock/atomic writer, preserves specialized recovery flows, and retains explicit key overrides.
• Stops automatic replay after 23 hours, before server replay expiry, and reports saved recovery state without automatically retrying refusals or discarding revision checks.
• Adds agent connect --no-wait: read one status snapshot, return a pending handoff with exact resume arguments, or finish an approved connection. It preserves the selected config/API origin and does not reopen approval pages for approved connections. Existing blocking behavior and terminal cancellation handling remain intact.
• Documents both workflows and adds regression coverage for response loss, request changes, concurrent retries, expiry, corrupted state, application acceptance followed by status failure, and pending-to-active connection resumption.

Validation:

• Build, typecheck, lint, public repository check, mock smoke, and git diff --check passed.
• Focused CLI/recovery/connection/help/output tests: 185 passed.
• Final direct full suite: 595 tests; 588 passed, 6 failed, 1 skipped. Five compose tests require Liberation fonts missing on this host; the sixth is existing sibling SDK drift. The logging socket tests pass outside the sandbox.
• npm test stops at its vendor gate because the bundled SDK differs from the sibling backend's generated SDK. No vendored inputs or hashes were changed.
• Package dry run passed: 406 files.

Dependency reinstallation, release packaging, npm installation, and live-server/plugin/player gates were not run. No backend or plugin files changed; this PR does not claim live deployment or installed-plugin verification.