add tcp daemon listener with token auth

CHANGELOG.md

@@ -17,6 +17,14 @@ loosely follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
   on demand and attaches a thin terminal client over the unix-socket
   transport; `--in-process` or `PATTERM_NO_DAEMON=1` keeps the legacy
   single-process path available as an escape hatch.
+- `patterm daemon --listen HOST:PORT` can now opt into a TCP listener
+  for remote human clients, with the unix socket still enabled for
+  local clients.
+- `patterm connect --host HOST:PORT [--token TOKEN]` attaches the thin
+  client to a remote daemon over the same transport protocol.
+- TCP attaches now require a lightweight bearer token stored under
+  `$XDG_DATA_HOME/patterm/clients/token`; local unix-socket attaches
+  remain exempt and rely on socket file permissions.
 - patterm can now keep multiple local projects loaded in one loopback
   daemon core, with command-palette entries to switch the current
   client view or open another project without tearing down processes